CVE-2017-10913

xen: Races in the grant table unmap code (XSA-218)

The grant-table feature in Xen through 4.8.x provides false mapping information in certain cases of concurrent unmap calls, which allows backend attackers to obtain sensitive information or gain privileges, aka XSA-218 bug 1.

CVSS 3.0 · 9.8 Critical EPSS 2.8% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2016-9384

xen: guest 32-bit ELF symbol table load leaking host data (XSA-194)

Xen 4.7 allows local guest OS users to obtain sensitive host information by loading a 32-bit ELF symbol table.

CVSS 3.0 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2016-9385

xen: x86 segment base write emulation lacking canonical address checks (XSA-193)

The x86 segment base write emulation functionality in Xen 4.4.x through 4.7.x allows local x86 PV guest OS administrators to cause a denial of service (host crash) by leveraging lack of canonical address checks.

CVSS 3.0 · 6.0 Medium EPSS < 1% KEV · Not listed

Vendors

Citrix Xen

Products

Xenserver Xen

CVE-2016-9383

xen: x86 64-bit bit test instruction emulation broken (XSA-195)

Xen, when running on a 64-bit hypervisor, allows local x86 guest OS users to modify arbitrary memory and consequently obtain sensitive information, cause a denial of service (host crash), or execute arbitrary code on the host by leveraging broken emulation of bit test instructions.

CVSS 3.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Citrix Xen

Products

Xenserver Xen

CVE-2017-14316

xen: Missing NUMA node parameter verification (XSA-231)

A parameter verification issue was discovered in Xen through 4.9.x. The function `alloc_heap_pages` allows callers to specify the first NUMA node that should be used for allocations through the `memflags` parameter; the node is extracted using the `MEMF_get_node` macro. While the function checks to see if the special constant `NUMA_NO_NODE` is specified, it otherwise does not handle the case where `node >= MAX_NUMNODES`. This allows an out-of-bounds access to an internal array.

CVSS 3.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2016-9380

xen: delimiter injection vulnerabilities in pygrub (XSA-198)

The pygrub boot loader emulator in Xen, when nul-delimited output format is requested, allows local pygrub-using guest OS administrators to read or delete arbitrary files on the host via NUL bytes in the bootloader configuration file.

CVSS 3.0 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Citrix Xen

Products

Xenserver Xen

CVE-2015-7504

Qemu: net: pcnet: heap overflow vulnerability in pcnet_receive

Heap-based buffer overflow in the pcnet_receive function in hw/net/pcnet.c in QEMU allows guest OS administrators to cause a denial of service (instance crash) or possibly execute arbitrary code via a series of packets in loopback mode.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Debian Qemu Redhat and 1 more

Products

Debian Linux Qemu Enterprise Linux and 2 more

CVE-2016-9818

xen: ARM guests may induce host asynchronous abort (XSA-201)

Xen through 4.7.x allows local ARM guest OS users to cause a denial of service (host crash) via vectors involving an asynchronous abort while at HYP.

CVSS 3.0 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2016-9379

xen: delimiter injection vulnerabilities in pygrub (XSA-198)

The pygrub boot loader emulator in Xen, when S-expression output format is requested, allows local pygrub-using guest OS administrators to read or delete arbitrary files on the host via string quotes and S-expressions in the bootloader configuration file.

CVSS 3.0 · 7.9 High EPSS < 1% KEV · Not listed

Vendors

Citrix Xen

Products

Xenserver Xen

CVE-2016-9382

xen: x86 task switch to VM86 mode mis-handled (XSA-192)

Xen 4.0.x through 4.7.x mishandle x86 task switches to VM86 mode, which allows local 32-bit x86 HVM guest OS users to gain privileges or cause a denial of service (guest OS crash) by leveraging a guest operating system that uses hardware task switching and allows a new task to start in VM86 mode.

CVSS 3.0 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Citrix Xen

Products

Xenserver Xen

CVE-2017-10914

xen: Races in the grant table unmap code (XSA-218)

The grant-table feature in Xen through 4.8.x has a race condition leading to a double free, which allows guest OS users to cause a denial of service (memory consumption), or possibly obtain sensitive information or gain privileges, aka XSA-218 bug 2.

CVSS 3.0 · 8.1 High EPSS 1.6% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2016-9377

xen: x86 software interrupt injection mis-handled (XSA-196)

Xen 4.5.x through 4.7.x on AMD systems without the NRip feature, when emulating instructions that generate software interrupts, allows local HVM guest OS users to cause a denial of service (guest crash) by leveraging IDT entry miscalculation.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2016-9378

xen: x86 software interrupt injection mis-handled (XSA-196)

Xen 4.5.x through 4.7.x on AMD systems without the NRip feature, when emulating instructions that generate software interrupts, allows local HVM guest OS users to cause a denial of service (guest crash) by leveraging an incorrect choice for software interrupt delivery.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2016-10024

xen: x86 PV guests may be able to mask interrupts (XSA-202)

Xen through 4.8.x allows local x86 PV guest OS kernel administrators to cause a denial of service (host hang or crash) by modifying the instruction stream asynchronously while performing certain kernel operations.

CVSS 3.0 · 6.0 Medium EPSS < 1% KEV · Not listed

Vendors

Citrix Xen

Products

Xenserver Xen

CVE-2016-10025

xen: x86: missing NULL pointer check in VMFUNC emulation (XSA-203)

VMFUNC emulation in Xen 4.6.x through 4.8.x on x86 systems using AMD virtualization extensions (aka SVM) allows local HVM guest OS users to cause a denial of service (hypervisor crash) by leveraging a missing NULL pointer check.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Citrix Xen

Products

Xenserver Xen

CVE-2017-14317

xen: cxenstored: Race in domain cleanup (XSA-233)

A domain cleanup issue was discovered in the C xenstore daemon (aka cxenstored) in Xen through 4.9.x. When shutting down a VM with a stubdomain, a race in cxenstored may cause a double-free. The xenstored daemon may crash, resulting in a DoS of any parts of the system relying on it (including domain creation / destruction, ballooning, device changes, etc.).

CVSS 3.0 · 5.6 Medium EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2016-10013

xen: x86: Mishandling of SYSCALL singlestep during emulation (XSA-204)

Xen through 4.8.x allows local 64-bit x86 HVM guest OS users to gain privileges by leveraging mishandling of SYSCALL singlestep during emulation.

CVSS 3.0 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2016-9386

xen: x86 null segments not always treated as unusable (XSA-191)

The x86 emulator in Xen does not properly treat x86 NULL segments as unusable when accessing memory, which might allow local HVM guest users to gain privileges via vectors involving "unexpected" base/limit values.

CVSS 3.0 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Citrix Xen

Products

Xenserver Xen

CVE-2014-7188

kernel: xen: Improper MSR range used for x2APIC emulation (xsa108)

The hvm_msr_read_intercept function in arch/x86/hvm/hvm.c in Xen 4.1 through 4.4.x uses an improper MSR range for x2APIC emulation, which allows local HVM guests to cause a denial of service (host crash) or read data from the hypervisor or other guests via unspecified vectors.

CVSS 2.0 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2014-7156

kernel: xen: Missing privilege level checks in x86 emulation of software interrupts (XSA-106)

The x86_emulate function in arch/x86/x86_emulate/x86_emulate.c in Xen 3.3.x through 4.4.x does not check the supervisor mode permissions for instructions that generate software interrupts, which allows local HVM guest users to cause a denial of service (guest crash) via unspecified vectors.

CVSS 2.0 · 3.3 Low EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen