Buffer overflow in Xen

CVE-2013-4553

The XEN_DOMCTL_getmemlist hypercall in Xen 3.4.x through 4.3.x (possibly 4.3.1) does not always obtain the page_alloc_lock and mm_rwlock in the same order, which allows local guest administrators to cause a denial of service (host deadlock).

Vulnerability class: Buffer Overflow

EPSS: 0.006 (43.6th percentile) — read the EPSS interpretation.

Affected products

  • Xen — versions 3.4.0, 3.4.1, 3.4.2
  • N/a — versions n/a

Weakness classification (CWE)

References