Search Results (Refine Search)
- Results Type: Overview
- Keyword (text search): cpe:2.3:o:xen:xen:4.0.1:*:*:*:*:*:x86:*
- CPE Name Search: true
Vuln ID | Summary | CVSS Severity |
---|---|---|
CVE-2016-9382 |
Xen 4.0.x through 4.7.x mishandle x86 task switches to VM86 mode, which allows local 32-bit x86 HVM guest OS users to gain privileges or cause a denial of service (guest OS crash) by leveraging a guest operating system that uses hardware task switching and allows a new task to start in VM86 mode. Published: January 23, 2017; 4:59:02 PM -0500 |
V3.0: 7.8 HIGH V2.0: 4.6 MEDIUM |
CVE-2016-9380 |
The pygrub boot loader emulator in Xen, when nul-delimited output format is requested, allows local pygrub-using guest OS administrators to read or delete arbitrary files on the host via NUL bytes in the bootloader configuration file. Published: January 23, 2017; 4:59:02 PM -0500 |
V3.0: 7.5 HIGH V2.0: 4.6 MEDIUM |
CVE-2016-9379 |
The pygrub boot loader emulator in Xen, when S-expression output format is requested, allows local pygrub-using guest OS administrators to read or delete arbitrary files on the host via string quotes and S-expressions in the bootloader configuration file. Published: January 23, 2017; 4:59:02 PM -0500 |
V3.0: 7.9 HIGH V2.0: 4.6 MEDIUM |
CVE-2016-7777 |
Xen 4.7.x and earlier does not properly honor CR0.TS and CR0.EM, which allows local x86 HVM guest OS users to read or modify FPU, MMX, or XMM register state information belonging to arbitrary tasks on the guest by modifying an instruction while the hypervisor is preparing to emulate it. Published: October 07, 2016; 10:59:10 AM -0400 |
V3.0: 6.3 MEDIUM V2.0: 3.3 LOW |
CVE-2016-7094 |
Buffer overflow in Xen 4.7.x and earlier allows local x86 HVM guest OS administrators on guests running with shadow paging to cause a denial of service via a pagetable update. Published: September 21, 2016; 10:25:25 AM -0400 |
V3.0: 4.1 MEDIUM V2.0: 1.5 LOW |
CVE-2016-6258 |
The PV pagetable code in arch/x86/mm.c in Xen 4.7.x and earlier allows local 32-bit PV guest OS administrators to gain host OS privileges by leveraging fast-paths for updating pagetable entries. Published: August 02, 2016; 12:59:08 PM -0400 |
V3.0: 8.8 HIGH V2.0: 7.2 HIGH |
CVE-2016-4963 |
The libxl device-handling in Xen through 4.6.x allows local guest OS users with access to the driver domain to cause a denial of service (management tool confusion) by manipulating information in the backend directories in xenstore. Published: June 07, 2016; 10:06:16 AM -0400 |
V3.0: 4.7 MEDIUM V2.0: 1.9 LOW |
CVE-2014-3672 |
The qemu implementation in libvirt before 1.3.0 and Xen allows local guest OS users to cause a denial of service (host disk consumption) by writing to stdout or stderr. Published: May 25, 2016; 11:59:00 AM -0400 |
V3.0: 6.5 MEDIUM V2.0: 2.1 LOW |
CVE-2016-4480 |
The guest_walk_tables function in arch/x86/mm/guest_walk.c in Xen 4.6.x and earlier does not properly handle the Page Size (PS) page table entry bit at the L4 and L3 page table levels, which might allow local guest OS users to gain privileges via a crafted mapping of memory. Published: May 18, 2016; 10:59:05 AM -0400 |
V3.0: 8.4 HIGH V2.0: 7.2 HIGH |
CVE-2016-3961 |
Xen and the Linux kernel through 4.5.x do not properly suppress hugetlbfs support in x86 PV guests, which allows local PV guest OS users to cause a denial of service (guest OS crash) by attempting to access a hugetlbfs mapped area. Published: April 15, 2016; 10:59:14 AM -0400 |
V3.0: 5.5 MEDIUM V2.0: 2.1 LOW |
CVE-2015-8554 |
Buffer overflow in hw/pt-msi.c in Xen 4.6.x and earlier, when using the qemu-xen-traditional (aka qemu-dm) device model, allows local x86 HVM guest administrators to gain privileges by leveraging a system with access to a passed-through MSI-X capable physical PCI device and MSI-X table entries, related to a "write path." Published: April 14, 2016; 10:59:05 AM -0400 |
V3.0: 7.5 HIGH V2.0: 6.6 MEDIUM |
CVE-2016-3158 |
The xrstor function in arch/x86/xstate.c in Xen 4.x does not properly handle writes to the hardware FSW.ES bit when running on AMD64 processors, which allows local guest OS users to obtain sensitive register content information from another guest by leveraging pending exception and mask bits. NOTE: this vulnerability exists because of an incorrect fix for CVE-2013-2076. Published: April 13, 2016; 12:59:18 PM -0400 |
V3.0: 3.8 LOW V2.0: 1.7 LOW |
CVE-2015-8552 |
The PCI backend driver in Xen, when running on an x86 system and using Linux 3.1.x through 4.3.x as the driver domain, allows local guest administrators to generate a continuous stream of WARN messages and cause a denial of service (disk consumption) by leveraging a system with access to a passed-through MSI or MSI-X capable physical PCI device and XEN_PCI_OP_enable_msi operations, aka "Linux pciback missing sanity checks." Published: April 13, 2016; 11:59:06 AM -0400 |
V3.0: 4.4 MEDIUM V2.0: 1.7 LOW |
CVE-2016-2270 |
Xen 4.6.x and earlier allows local guest administrators to cause a denial of service (host reboot) via vectors related to multiple mappings of MMIO pages with different cachability settings. Published: February 19, 2016; 11:59:00 AM -0500 |
V3.0: 6.8 MEDIUM V2.0: 4.6 MEDIUM |
CVE-2015-8340 |
The memory_exchange function in common/memory.c in Xen 3.2.x through 4.6.x does not properly release locks, which might allow guest OS administrators to cause a denial of service (deadlock or host crash) via unspecified vectors, related to XENMEM_exchange error handling. Published: December 17, 2015; 2:59:08 PM -0500 |
V3.x:(not available) V2.0: 4.7 MEDIUM |
CVE-2015-8339 |
The memory_exchange function in common/memory.c in Xen 3.2.x through 4.6.x does not properly hand back pages to a domain, which might allow guest OS administrators to cause a denial of service (host crash) via unspecified vectors related to domain teardown. Published: December 17, 2015; 2:59:07 PM -0500 |
V3.x:(not available) V2.0: 4.7 MEDIUM |
CVE-2015-8338 |
Xen 4.6.x and earlier does not properly enforce limits on page order inputs for the (1) XENMEM_increase_reservation, (2) XENMEM_populate_physmap, (3) XENMEM_exchange, and possibly other HYPERVISOR_memory_op suboperations, which allows ARM guest OS administrators to cause a denial of service (CPU consumption, guest reboot, or watchdog timeout and host reboot) and possibly have unspecified other impact via unknown vectors. Published: December 17, 2015; 2:59:06 PM -0500 |
V3.x:(not available) V2.0: 7.2 HIGH |
CVE-2015-7972 |
The (1) libxl_set_memory_target function in tools/libxl/libxl.c and (2) libxl__build_post function in tools/libxl/libxl_dom.c in Xen 3.4.x through 4.6.x do not properly calculate the balloon size when using the populate-on-demand (PoD) system, which allows local HVM guest users to cause a denial of service (guest crash) via unspecified vectors related to "heavy memory pressure." Published: October 30, 2015; 11:59:09 AM -0400 |
V3.x:(not available) V2.0: 2.1 LOW |
CVE-2015-7971 |
Xen 3.2.x through 4.6.x does not limit the number of printk console messages when logging certain pmu and profiling hypercalls, which allows local guests to cause a denial of service via a sequence of crafted (1) HYPERCALL_xenoprof_op hypercalls, which are not properly handled in the do_xenoprof_op function in common/xenoprof.c, or (2) HYPERVISOR_xenpmu_op hypercalls, which are not properly handled in the do_xenpmu_op function in arch/x86/cpu/vpmu.c. Published: October 30, 2015; 11:59:07 AM -0400 |
V3.x:(not available) V2.0: 2.1 LOW |
CVE-2015-7969 |
Multiple memory leaks in Xen 4.0 through 4.6.x allow local guest administrators or domains with certain permission to cause a denial of service (memory consumption) via a large number of "teardowns" of domains with the vcpu pointer array allocated using the (1) XEN_DOMCTL_max_vcpus hypercall or the xenoprofile state vcpu pointer array allocated using the (2) XENOPROF_get_buffer or (3) XENOPROF_set_passive hypercall. Published: October 30, 2015; 11:59:05 AM -0400 |
V3.x:(not available) V2.0: 4.9 MEDIUM |