Xen
Page 2 of 6 — Xen CVEs from a corpus of 532, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-42316 | Medium | 6.5 | 2022-11-01 | Xenstore: guests can let run xenstored out of memory T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities cor… |
CVE-2022-42315 | Medium | 6.5 | 2022-11-01 | Xenstore: guests can let run xenstored out of memory T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities cor… |
CVE-2022-42314 | Medium | 6.5 | 2022-11-01 | Xenstore: guests can let run xenstored out of memory T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities cor… |
CVE-2022-42313 | Medium | 6.5 | 2022-11-01 | Xenstore: guests can let run xenstored out of memory T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities cor… |
CVE-2022-42312 | Medium | 6.5 | 2022-11-01 | Xenstore: guests can let run xenstored out of memory T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities cor… |
CVE-2022-42311 | Medium | 6.5 | 2022-11-01 | Xenstore: guests can let run xenstored out of memory T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities cor… |
CVE-2022-42310 | Medium | 5.5 | 2022-11-01 | Xenstore: Guests can create orphaned Xenstore nodes By creating multiple nodes inside a transaction resulting in an error, a malicious guest can create orphane… |
CVE-2022-42309 | High | 8.8 | 2022-11-01 | Xenstore: Guests can crash xenstored Due to a bug in the fix of XSA-115 a malicious guest can cause xenstored to use a wrong pointer during node creation in an… |
CVE-2022-33749 | Medium | 5.3 | 2022-10-11 | XAPI open file limit DoS It is possible for an unauthenticated client on the network to cause XAPI to hit its file-descriptor limit. This causes XAPI to be una… |
CVE-2022-33748 | Medium | 5.6 | 2022-10-11 | lock order inversion in transitive grant copy handling As part of XSA-226 a missing cleanup call was inserted on an error handling path. While doing so, lockin… |
CVE-2022-33747 | Low | 3.8 | 2022-10-11 | Arm: unbounded memory consumption for 2nd-level page tables Certain actions require e.g. removing pages from a guest's P2M (Physical-to-Machine) mapping. When… |
CVE-2022-33746 | Medium | 6.5 | 2022-10-11 | P2M pool freeing may take excessively long The P2M pool backing second level address translation for guests may be of significant size. Therefore its freeing m… |
CVE-2022-33745 | High | 8.8 | 2022-07-26 | insufficient TLB flush for x86 PV guests in shadow mode For migration as well as to work around kernels unaware of L1TF (see XSA-273), PV guests may be run in… |
CVE-2022-29901 | Medium | 5.6 | 2022-07-12 | Intel microprocessor generations 6 to 8 are affected by a new Spectre variant that is able to bypass their retpoline mitigation in the kernel to leak arbitrary… |
CVE-2022-29900 | Medium | 6.5 | 2022-07-12 | Mis-trained branch predictions for return instructions may allow arbitrary speculative code execution under certain microarchitecture-dependent conditions. |
CVE-2022-33743 | High | 7.8 | 2022-07-05 | network backend may cause Linux netfront to use freed SKBs While adding logic to support XDP (eXpress Data Path), a code label was moved in a way allowing for… |
CVE-2022-33742 | High | 7.1 | 2022-07-05 | Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which… |
CVE-2022-33741 | High | 7.1 | 2022-07-05 | Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which… |
CVE-2022-33740 | High | 7.1 | 2022-07-05 | Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which… |
CVE-2022-26365 | High | 7.1 | 2022-07-05 | Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which… |
CVE-2022-21166 | Medium | 5.5 | 2022-06-15 | Incomplete cleanup in specific special register write operations for some Intel(R) Processors may allow an authenticated user to potentially enable information… |
CVE-2022-21127 | Medium | 5.5 | 2022-06-15 | Incomplete cleanup in specific special register read operations for some Intel(R) Processors may allow an authenticated user to potentially enable information… |
CVE-2022-21125 | Medium | 5.5 | 2022-06-15 | Incomplete cleanup of microarchitectural fill buffers on some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure… |
CVE-2022-21123 | Medium | 5.5 | 2022-06-15 | Incomplete cleanup of multi-core shared buffers for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via l… |
CVE-2022-26364 | Medium | 6.7 | 2022-06-09 | x86 pv: Insufficient care with non-coherent mappings T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities cor… |
CVE-2022-26363 | Medium | 6.7 | 2022-06-09 | x86 pv: Insufficient care with non-coherent mappings T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities cor… |
CVE-2022-26362 | Medium | 6.4 | 2022-06-09 | x86 pv: Race condition in typeref acquisition Xen maintains a type reference count for pages, in addition to a regular reference count. This scheme is used to… |
CVE-2022-26361 | High | 7.8 | 2022-04-05 | IOMMU: RMRR (VT-d) and unity map (AMD-Vi) handling issues T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilitie… |
CVE-2022-26360 | High | 7.8 | 2022-04-05 | IOMMU: RMRR (VT-d) and unity map (AMD-Vi) handling issues T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilitie… |
CVE-2022-26359 | High | 7.8 | 2022-04-05 | IOMMU: RMRR (VT-d) and unity map (AMD-Vi) handling issues T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilitie… |
CVE-2022-26358 | High | 7.8 | 2022-04-05 | IOMMU: RMRR (VT-d) and unity map (AMD-Vi) handling issues T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilitie… |
CVE-2022-26357 | High | 7.0 | 2022-04-05 | race in VT-d domain ID cleanup Xen domain IDs are up to 15 bits wide. VT-d hardware may allow for only less than 15 bits to hold a domain ID associating a phys… |
CVE-2022-26356 | Medium | 5.6 | 2022-04-05 | Racy interactions between dirty vram tracking and paging log dirty hypercalls Activation of log dirty mode done by XEN_DMOP_track_dirty_vram (was named HVMOP_t… |
CVE-2022-23960 | Medium | 5.6 | 2022-03-13 | Certain Arm Cortex and Neoverse processors through 2022-03-08 do not properly restrict cache speculation, aka Spectre-BHB. An attacker can leverage the shared… |
CVE-2022-23042 | High | 7.0 | 2022-03-10 | Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilit… |
CVE-2022-23041 | High | 7.0 | 2022-03-10 | Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilit… |
CVE-2022-23040 | High | 7.0 | 2022-03-10 | Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilit… |
CVE-2022-23039 | High | 7.0 | 2022-03-10 | Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilit… |
CVE-2022-23038 | High | 7.0 | 2022-03-10 | Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilit… |
CVE-2022-23037 | High | 7.0 | 2022-03-10 | Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilit… |
CVE-2022-23036 | High | 7.0 | 2022-03-10 | Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilit… |
CVE-2022-23035 | Medium | 4.6 | 2022-01-25 | Insufficient cleanup of passed-through device IRQs The management of IRQs associated with physical devices exposed to x86 HVM guests involves an iterative oper… |
CVE-2022-23034 | Medium | 5.5 | 2022-01-25 | A PV guest could DoS Xen while unmapping a grant To address XSA-380, reference counting was introduced for grant mappings for the case where a PV guest would h… |
CVE-2022-23033 | High | 7.8 | 2022-01-25 | arm: guest_physmap_remove_page not removing the p2m mappings The functions to remove one or more entries from a guest p2m pagetable on Arm (p2m_remove_mapping… |
CVE-2021-28713 | Medium | 6.5 | 2022-01-05 | Rogue backends can cause DoS of guests via high frequency events T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnera… |
CVE-2021-28712 | Medium | 6.5 | 2022-01-05 | Rogue backends can cause DoS of guests via high frequency events T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnera… |
CVE-2021-28711 | Medium | 6.5 | 2022-01-05 | Rogue backends can cause DoS of guests via high frequency events T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnera… |
CVE-2021-28703 | High | 7.0 | 2021-12-07 | grant table v2 status pages may remain accessible after de-allocation (take two) Guest get permitted access to certain Xen-owned pages of memory. The majority… |
CVE-2021-28709 | High | 7.8 | 2021-11-24 | issues with partially successful P2M updates on x86 T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities corr… |
CVE-2021-28705 | High | 7.8 | 2021-11-24 | issues with partially successful P2M updates on x86 T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities corr… |
CVE-2021-28708 | High | 8.8 | 2021-11-24 | PoD operations on misaligned GFNs T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CV… |
CVE-2021-28707 | High | 8.8 | 2021-11-24 | PoD operations on misaligned GFNs T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CV… |
CVE-2021-28706 | High | 8.6 | 2021-11-24 | guests may exceed their designated memory limit When a guest is permitted to have close to 16TiB of memory, it may be able to issue hypercalls to increase its… |
CVE-2021-28704 | High | 8.8 | 2021-11-24 | PoD operations on misaligned GFNs T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CV… |
CVE-2021-28710 | High | 8.8 | 2021-11-21 | certain VT-d IOMMUs may not work in shared page table mode For efficiency reasons, address translation control structures (page tables) may (and, on suitable h… |
CVE-2021-28702 | High | 7.6 | 2021-10-06 | PCI devices with RMRRs not deassigned correctly Certain PCI devices in a system might be assigned Reserved Memory Regions (specified via Reserved Memory Region… |
CVE-2021-28701 | High | 7.8 | 2021-09-08 | Another race in XENMAPSPACE_grant_table handling Guests are permitted access to certain Xen-owned pages of memory. The majority of such pages remain allocated… |
CVE-2021-28700 | Medium | 4.9 | 2021-08-27 | xen/arm: No memory limit for dom0less domUs The dom0less feature allows an administrator to create multiple unprivileged domains directly from Xen. Unfortunate… |
CVE-2021-28699 | Medium | 5.5 | 2021-08-27 | inadequate grant-v2 status frames array bounds check The v2 grant table interface separates grant attributes from grant status. That is, when operating in this… |
CVE-2021-28698 | Medium | 5.5 | 2021-08-27 | long running loops in grant table handling In order to properly monitor resource use, Xen maintains information on the grant mappings a domain may create to ma… |
CVE-2021-28697 | High | 7.8 | 2021-08-27 | grant table v2 status pages may remain accessible after de-allocation Guest get permitted access to certain Xen-owned pages of memory. The majority of such pag… |
CVE-2021-28696 | Medium | 6.8 | 2021-08-27 | IOMMU page mapping issues on x86 T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE… |
CVE-2021-28695 | Medium | 6.8 | 2021-08-27 | IOMMU page mapping issues on x86 T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE… |
CVE-2021-28694 | Medium | 6.8 | 2021-08-27 | IOMMU page mapping issues on x86 T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE… |
CVE-2021-28693 | Medium | 5.5 | 2021-06-30 | xen/arm: Boot modules are not scrubbed The bootloader will load boot modules (e.g. kernel, initramfs...) in a temporary area before they are copied by Xen to e… |
CVE-2021-28692 | High | 7.1 | 2021-06-30 | inappropriate x86 IOMMU timeout detection / handling IOMMUs process commands issued to them in parallel with the operation of the CPU(s) issuing such commands… |
CVE-2021-28690 | Medium | 6.5 | 2021-06-29 | x86: TSX Async Abort protections not restored after S3 This issue relates to the TSX Async Abort speculative security vulnerability. Please see https://xenbits… |
CVE-2021-28689 | Medium | 5.5 | 2021-06-11 | x86: Speculative vulnerabilities with bare (non-shim) 32-bit PV guests 32-bit x86 PV guest kernels run in ring 1. At the time when Xen was developed, this area… |
CVE-2021-28687 | Medium | 5.5 | 2021-06-11 | HVM soft-reset crashes toolstack libxl requires all data structures passed across its public interface to be initialized before use and disposed of afterwards… |
CVE-2021-26314 | Medium | 5.5 | 2021-06-09 | Potential floating point value injection in all supported CPU products, in conjunction with software vulnerabilities relating to speculative execution with inc… |
CVE-2021-26313 | Medium | 5.5 | 2021-06-09 | Potential speculative code store bypass in all supported CPU products, in conjunction with software vulnerabilities relating to speculative execution of overwr… |
CVE-2021-28039 | Medium | 6.5 | 2021-03-05 | An issue was discovered in the Linux kernel 5.9.x through 5.11.3, as used with Xen. In some less-common configurations, an x86 PV guest OS user can crash a Dom… |
CVE-2021-27379 | High | 7.8 | 2021-02-18 | An issue was discovered in Xen through 4.11.x, allowing x86 Intel HVM guest OS users to achieve unintended read/write DMA access, and possibly cause a denial o… |
CVE-2021-26933 | Medium | 5.5 | 2021-02-17 | An issue was discovered in Xen 4.9 through 4.14.x. On Arm, a guest is allowed to control whether memory accesses are bypassing the cache. This means that Xen n… |
CVE-2021-3308 | Medium | 5.5 | 2021-01-26 | An issue was discovered in Xen 4.12.3 through 4.12.4 and 4.13.1 through 4.14.x. An x86 HVM guest with PCI pass through devices can force the allocation of all… |
CVE-2020-29487 | High | 7.5 | 2020-12-15 | An issue was discovered in Xen XAPI before 2020-12-15. Certain xenstore keys provide feedback from the guest, and are therefore watched by toolstack. Specifica… |
CVE-2020-29486 | Medium | 6.0 | 2020-12-15 | An issue was discovered in Xen through 4.14.x. Nodes in xenstore have an ownership. In oxenstored, a owner could give a node away. However, node ownership has… |
CVE-2020-29485 | Medium | 5.5 | 2020-12-15 | An issue was discovered in Xen 4.6 through 4.14.x. When acting upon a guest XS_RESET_WATCHES request, not all tracking information is freed. A guest can cause… |
CVE-2020-29484 | Medium | 6.0 | 2020-12-15 | An issue was discovered in Xen through 4.14.x. When a Xenstore watch fires, the xenstore client that registered the watch will receive a Xenstore message conta… |
CVE-2020-29483 | Medium | 6.5 | 2020-12-15 | An issue was discovered in Xen through 4.14.x. Xenstored and guests communicate via a shared memory page using a specific protocol. When a guest violates this… |
CVE-2020-29482 | Medium | 6.0 | 2020-12-15 | An issue was discovered in Xen through 4.14.x. A guest may access xenstore paths via absolute paths containing a full pathname, or via a relative path, which i… |
CVE-2020-29481 | High | 8.8 | 2020-12-15 | An issue was discovered in Xen through 4.14.x. Access rights of Xenstore nodes are per domid. Unfortunately, existing granted access rights are not removed whe… |
CVE-2020-29480 | Low | 2.3 | 2020-12-15 | An issue was discovered in Xen through 4.14.x. Neither xenstore implementation does any permission checks when reporting a xenstore watch event. A guest admini… |
CVE-2020-29479 | High | 8.8 | 2020-12-15 | An issue was discovered in Xen through 4.14.x. In the Ocaml xenstored implementation, the internal representation of the tree has special cases for the root no… |
CVE-2020-29571 | Medium | 6.2 | 2020-12-15 | An issue was discovered in Xen through 4.14.x. A bounds check common to most operation time functions specific to FIFO event channels depends on the CPU observ… |
CVE-2020-29570 | Medium | 6.2 | 2020-12-15 | An issue was discovered in Xen through 4.14.x. Recording of the per-vCPU control block mapping maintained by Xen and that of pointers into the control block is… |
CVE-2020-29569 | High | 8.8 | 2020-12-15 | An issue was discovered in the Linux kernel through 5.10.1, as used with Xen through 4.14.x. The Linux kernel PV block backend expects the kernel thread handle… |
CVE-2020-29568 | Medium | 6.5 | 2020-12-15 | An issue was discovered in Xen through 4.14.x. Some OSes (such as Linux, FreeBSD, and NetBSD) are processing watch events using a single thread. If the events… |
CVE-2020-29567 | Medium | 6.2 | 2020-12-15 | An issue was discovered in Xen 4.14.x. When moving IRQs between CPUs to distribute the load of IRQ handling, IRQ vectors are dynamically allocated and de-alloc… |
CVE-2020-29566 | Medium | 5.5 | 2020-12-15 | An issue was discovered in Xen through 4.14.x. When they require assistance from the device model, x86 HVM guests must be temporarily de-scheduled. The device… |
CVE-2020-29040 | High | 8.8 | 2020-11-24 | An issue was discovered in Xen through 4.14.x allowing x86 HVM guest OS users to cause a denial of service (stack corruption), cause a data leak, or possibly g… |
CVE-2020-28368 | Medium | 4.4 | 2020-11-10 | Xen through 4.14.x allows guest OS administrators to obtain sensitive information (such as AES keys from outside the guest) via a side-channel attack on a powe… |
CVE-2020-27674 | Medium | 5.3 | 2020-10-22 | An issue was discovered in Xen through 4.14.x allowing x86 PV guest OS users to gain guest OS privileges by modifying kernel memory contents, because invalidat… |
CVE-2020-27673 | Medium | 5.5 | 2020-10-22 | An issue was discovered in the Linux kernel through 5.9.1, as used with Xen through 4.14.x. Guest OS users can cause a denial of service (host OS hang) via a h… |
CVE-2020-27672 | High | 7.0 | 2020-10-22 | An issue was discovered in Xen through 4.14.x allowing x86 guest OS users to cause a host OS denial of service, achieve data corruption, or possibly gain privi… |
CVE-2020-27671 | High | 7.8 | 2020-10-22 | An issue was discovered in Xen through 4.14.x allowing x86 HVM and PVH guest OS users to cause a denial of service (data corruption), cause a data leak, or pos… |
CVE-2020-27670 | High | 7.8 | 2020-10-22 | An issue was discovered in Xen through 4.14.x allowing x86 guest OS users to cause a denial of service (data corruption), cause a data leak, or possibly gain p… |
CVE-2020-25604 | Medium | 4.7 | 2020-09-23 | An issue was discovered in Xen through 4.14.x. There is a race condition when migrating timers between x86 HVM vCPUs. When migrating timers of x86 HVM guests b… |
CVE-2020-25603 | High | 7.8 | 2020-09-23 | An issue was discovered in Xen through 4.14.x. There are missing memory barriers when accessing/allocating an event channel. Event channels control structures… |
CVE-2020-25602 | Medium | 6.0 | 2020-09-23 | An issue was discovered in Xen through 4.14.x. An x86 PV guest can trigger a host OS crash when handling guest access to MSR_MISC_ENABLE. When a guest accesses… |