Improper input validation in Xen

CVE-2013-1952

Xen 4.x, when using Intel VT-d for a bus mastering capable PCI device, does not properly check the source when accessing a bridge device's interrupt remapping table entries for MSI interrupts, which allows local guest domains to cause a denial of service (interrupt injection) via unspecified vectors.

Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)

EPSS: 0.004 (34.6th percentile) — read the EPSS interpretation.

Affected products

  • Xen — versions 4.0.0, 4.0.1, 4.0.2
  • N/a — versions n/a

Weakness classification (CWE)

References