Xen
Page 4 of 4 — Xen CVEs from a corpus of 387, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-10922 | High | 7.5 | 2017-07-05 | The grant-table feature in Xen through 4.8.x mishandles MMIO region grant references, which allows guest OS users to cause a denial of service (loss of grant t… |
CVE-2017-10921 | Critical | 10.0 | 2017-07-05 | The grant-table feature in Xen through 4.8.x does not ensure sufficient type counts for a GNTMAP_device_map and GNTMAP_host_map mapping, which allows guest OS… |
CVE-2017-10920 | Critical | 10.0 | 2017-07-05 | The grant-table feature in Xen through 4.8.x mishandles a GNTMAP_device_map and GNTMAP_host_map mapping, when followed by only a GNTMAP_host_map unmapping, whi… |
CVE-2017-10919 | Medium | 6.5 | 2017-07-05 | Xen through 4.8.x mishandles virtual interrupt injection, which allows guest OS users to cause a denial of service (hypervisor crash), aka XSA-223. |
CVE-2017-10918 | Critical | 10.0 | 2017-07-05 | Xen through 4.8.x does not validate memory allocations during certain P2M operations, which allows guest OS users to obtain privileged host OS access, aka XSA-… |
CVE-2017-10917 | Critical | 9.1 | 2017-07-05 | Xen through 4.8.x does not validate the port numbers of polled event channel ports, which allows guest OS users to cause a denial of service (NULL pointer dere… |
CVE-2017-10916 | High | 7.5 | 2017-07-05 | The vCPU context-switch implementation in Xen through 4.8.x improperly interacts with the Memory Protection Extensions (MPX) and Protection Key (PKU) features… |
CVE-2017-10915 | Critical | 9.0 | 2017-07-05 | The shadow-paging feature in Xen through 4.8.x mismanages page references and consequently introduces a race condition, which allows guest OS users to obtain X… |
CVE-2017-10914 | High | 8.1 | 2017-07-05 | The grant-table feature in Xen through 4.8.x has a race condition leading to a double free, which allows guest OS users to cause a denial of service (memory co… |
CVE-2017-10913 | Critical | 9.8 | 2017-07-05 | The grant-table feature in Xen through 4.8.x provides false mapping information in certain cases of concurrent unmap calls, which allows backend attackers to o… |
CVE-2017-10912 | Critical | 10.0 | 2017-07-05 | Xen through 4.8.x mishandles page transfer, which allows guest OS users to obtain privileged host OS access, aka XSA-217. |
CVE-2017-8905 | High | 8.8 | 2017-05-11 | Xen through 4.6.x on 64-bit platforms mishandles a failsafe callback, which might allow PV guest OS users to execute arbitrary code on the host OS, aka XSA-215. |
CVE-2017-8904 | High | 8.8 | 2017-05-11 | Xen through 4.8.x mishandles the "contains segment descriptors" property during GNTTABOP_transfer (aka guest transfer) operations, which might allow PV guest O… |
CVE-2017-8903 | High | 8.8 | 2017-05-11 | Xen through 4.8.x on 64-bit platforms mishandles page tables after an IRET hypercall, which might allow PV guest OS users to execute arbitrary code on the host… |
CVE-2017-7995 | Low | 3.8 | 2017-05-03 | Xen PV guest before Xen 4.3 checked access permissions to MMIO ranges only after accessing them, allowing host PCI device space memory reads, leading to inform… |
CVE-2017-7228 | High | 8.2 | 2017-04-04 | An issue (known as XSA-212) was discovered in Xen, with fixes available for 4.8.x, 4.7.x, 4.6.x, 4.5.x, and 4.4.x. The earlier XSA-29 fix introduced an insuffi… |
CVE-2016-9818 | Medium | 6.5 | 2017-02-27 | Xen through 4.7.x allows local ARM guest OS users to cause a denial of service (host crash) via vectors involving an asynchronous abort while at HYP. |
CVE-2016-9817 | Medium | 6.5 | 2017-02-27 | Xen through 4.7.x allows local ARM guest OS users to cause a denial of service (host crash) via vectors involving a (1) data or (2) prefetch abort with the ESR… |
CVE-2016-9816 | Medium | 6.5 | 2017-02-27 | Xen through 4.7.x allows local ARM guest OS users to cause a denial of service (host crash) via vectors involving an asynchronous abort while at EL2. |
CVE-2016-9815 | Medium | 6.5 | 2017-02-27 | Xen through 4.7.x allows local ARM guest OS users to cause a denial of service (host panic) by sending an asynchronous abort. |
CVE-2016-9384 | Medium | 6.5 | 2017-02-22 | Xen 4.7 allows local guest OS users to obtain sensitive host information by loading a 32-bit ELF symbol table. |
CVE-2016-9378 | Medium | 5.5 | 2017-02-22 | Xen 4.5.x through 4.7.x on AMD systems without the NRip feature, when emulating instructions that generate software interrupts, allows local HVM guest OS users… |
CVE-2016-9377 | Medium | 5.5 | 2017-02-22 | Xen 4.5.x through 4.7.x on AMD systems without the NRip feature, when emulating instructions that generate software interrupts, allows local HVM guest OS users… |
CVE-2016-9932 | Low | 3.3 | 2017-01-26 | CMPXCHG8B emulation in Xen 3.3.x through 4.7.x on x86 systems allows local HVM guest OS users to obtain sensitive information from host stack memory via a "sup… |
CVE-2016-10025 | Medium | 5.5 | 2017-01-26 | VMFUNC emulation in Xen 4.6.x through 4.8.x on x86 systems using AMD virtualization extensions (aka SVM) allows local HVM guest OS users to cause a denial of s… |
CVE-2016-10024 | Medium | 6.0 | 2017-01-26 | Xen through 4.8.x allows local x86 PV guest OS kernel administrators to cause a denial of service (host hang or crash) by modifying the instruction stream asyn… |
CVE-2016-10013 | High | 7.8 | 2017-01-26 | Xen through 4.8.x allows local 64-bit x86 HVM guest OS users to gain privileges by leveraging mishandling of SYSCALL singlestep during emulation. |
CVE-2016-9386 | High | 7.8 | 2017-01-23 | The x86 emulator in Xen does not properly treat x86 NULL segments as unusable when accessing memory, which might allow local HVM guest users to gain privileges… |
CVE-2016-9385 | Medium | 6.0 | 2017-01-23 | The x86 segment base write emulation functionality in Xen 4.4.x through 4.7.x allows local x86 PV guest OS administrators to cause a denial of service (host cr… |
CVE-2016-9383 | High | 8.8 | 2017-01-23 | Xen, when running on a 64-bit hypervisor, allows local x86 guest OS users to modify arbitrary memory and consequently obtain sensitive information, cause a den… |
CVE-2016-9382 | High | 7.8 | 2017-01-23 | Xen 4.0.x through 4.7.x mishandle x86 task switches to VM86 mode, which allows local 32-bit x86 HVM guest OS users to gain privileges or cause a denial of serv… |
CVE-2016-9380 | High | 7.5 | 2017-01-23 | The pygrub boot loader emulator in Xen, when nul-delimited output format is requested, allows local pygrub-using guest OS administrators to read or delete arbi… |
CVE-2016-9379 | High | 7.9 | 2017-01-23 | The pygrub boot loader emulator in Xen, when S-expression output format is requested, allows local pygrub-using guest OS administrators to read or delete arbit… |
CVE-2016-7777 | Medium | 6.3 | 2016-10-07 | Xen 4.7.x and earlier does not properly honor CR0.TS and CR0.EM, which allows local x86 HVM guest OS users to read or modify FPU, MMX, or XMM register state in… |
CVE-2016-7154 | Medium | 6.7 | 2016-09-21 | Use-after-free vulnerability in the FIFO event channel code in Xen 4.4.x allows local guest OS administrators to cause a denial of service (host crash) and pos… |
CVE-2016-7094 | Medium | 4.1 | 2016-09-21 | Buffer overflow in Xen 4.7.x and earlier allows local x86 HVM guest OS administrators on guests running with shadow paging to cause a denial of service via a p… |
CVE-2016-7093 | High | 8.2 | 2016-09-21 | Xen 4.5.3, 4.6.3, and 4.7.x allow local HVM guest OS administrators to overwrite hypervisor memory and consequently gain host OS privileges by leveraging misha… |
CVE-2016-7092 | High | 8.2 | 2016-09-21 | The get_page_from_l3e function in arch/x86/mm.c in Xen allows local 32-bit PV guest OS administrators to gain host OS privileges via vectors related to L3 recu… |
CVE-2016-6259 | Medium | 6.2 | 2016-08-02 | Xen 4.5.x through 4.7.x do not implement Supervisor Mode Access Prevention (SMAP) whitelisting in 32-bit exception and event delivery, which allows local 32-bi… |
CVE-2016-6258 | High | 8.8 | 2016-08-02 | The PV pagetable code in arch/x86/mm.c in Xen 4.7.x and earlier allows local 32-bit PV guest OS administrators to gain host OS privileges by leveraging fast-pa… |
CVE-2016-5242 | Medium | 5.6 | 2016-06-07 | The p2m_teardown function in arch/arm/p2m.c in Xen 4.4.x through 4.6.x allows local guest OS users with access to the driver domain to cause a denial of servic… |
CVE-2016-4963 | Medium | 4.7 | 2016-06-07 | The libxl device-handling in Xen through 4.6.x allows local guest OS users with access to the driver domain to cause a denial of service (management tool confu… |
CVE-2016-4962 | Medium | 6.7 | 2016-06-07 | The libxl device-handling in Xen 4.6.x and earlier allows local OS guest administrators to cause a denial of service (resource consumption or management facili… |
CVE-2014-3672 | Medium | 6.5 | 2016-05-25 | The qemu implementation in libvirt before 1.3.0 and Xen allows local guest OS users to cause a denial of service (host disk consumption) by writing to stdout o… |
CVE-2016-4480 | High | 8.4 | 2016-05-18 | The guest_walk_tables function in arch/x86/mm/guest_walk.c in Xen 4.6.x and earlier does not properly handle the Page Size (PS) page table entry bit at the L4… |
CVE-2016-3960 | High | 8.8 | 2016-04-19 | Integer overflow in the x86 shadow pagetable code in Xen allows local guest OS users to cause a denial of service (host crash) or possibly gain privileges by s… |
CVE-2016-3961 | Medium | 5.5 | 2016-04-15 | Xen and the Linux kernel through 4.5.x do not properly suppress hugetlbfs support in x86 PV guests, which allows local PV guest OS users to cause a denial of s… |
CVE-2015-8554 | High | 7.5 | 2016-04-14 | Buffer overflow in hw/pt-msi.c in Xen 4.6.x and earlier, when using the qemu-xen-traditional (aka qemu-dm) device model, allows local x86 HVM guest administrat… |
CVE-2015-8550 | High | 8.2 | 2016-04-14 | Xen, when used on a system providing PV backends, allows local guest OS administrators to cause a denial of service (host OS crash) or gain privileges by writi… |
CVE-2016-3159 | Low | 3.8 | 2016-04-13 | The fpu_fxrstor function in arch/x86/i387.c in Xen 4.x does not properly handle writes to the hardware FSW.ES bit when running on AMD64 processors, which allow… |
CVE-2016-3158 | Low | 3.8 | 2016-04-13 | The xrstor function in arch/x86/xstate.c in Xen 4.x does not properly handle writes to the hardware FSW.ES bit when running on AMD64 processors, which allows l… |
CVE-2015-8555 | High | 8.6 | 2016-04-13 | Xen 4.6.x, 4.5.x, 4.4.x, 4.3.x, and earlier do not initialize x86 FPU stack and XMM registers when XSAVE/XRSTOR are not used to manage guest extended register… |
CVE-2015-8553 | Medium | 6.5 | 2016-04-13 | Xen allows guest OS users to obtain sensitive information from uninitialized locations in host OS kernel memory by not enabling memory and I/O decoding control… |
CVE-2015-8552 | Medium | 4.4 | 2016-04-13 | The PCI backend driver in Xen, when running on an x86 system and using Linux 3.1.x through 4.3.x as the driver domain, allows local guest administrators to gen… |
CVE-2016-3157 | High | 7.8 | 2016-04-12 | The __switch_to function in arch/x86/kernel/process_64.c in the Linux kernel does not properly context-switch IOPL on 64-bit PV Xen guests, which allows local… |
CVE-2016-2271 | Medium | 5.5 | 2016-02-19 | VMX in Xen 4.6.x and earlier, when using an Intel or Cyrix CPU, allows local HVM guest users to cause a denial of service (guest crash) via vectors related to… |
CVE-2016-2270 | Medium | 6.8 | 2016-02-19 | Xen 4.6.x and earlier allows local guest administrators to cause a denial of service (host reboot) via vectors related to multiple mappings of MMIO pages with… |
CVE-2016-1571 | Medium | 6.3 | 2016-01-22 | The paging_invlpg function in include/asm-x86/paging.h in Xen 3.3.x through 4.6.x, when using shadow mode paging or nested virtualization is enabled, allows lo… |
CVE-2016-1570 | High | 8.5 | 2016-01-22 | The PV superpage functionality in arch/x86/mm.c in Xen 3.4.0, 3.4.1, and 4.1.x through 4.6.x allows local PV guests to obtain sensitive information, cause a de… |
CVE-2015-8615 | Medium | 5.0 | 2016-01-08 | The hvm_set_callback_via function in arch/x86/hvm/irq.c in Xen 4.6 does not limit the number of printk console messages when logging the new callback method, w… |
CVE-2015-8341 | | 2015-12-17 | The libxl toolstack library in Xen 4.1.x through 4.6.x does not properly release mappings of files used as kernels and initial ramdisks when managing multiple… | |
CVE-2015-8340 | | 2015-12-17 | The memory_exchange function in common/memory.c in Xen 3.2.x through 4.6.x does not properly release locks, which might allow guest OS administrators to cause… | |
CVE-2015-8339 | | 2015-12-17 | The memory_exchange function in common/memory.c in Xen 3.2.x through 4.6.x does not properly hand back pages to a domain, which might allow guest OS administra… | |
CVE-2015-8338 | | 2015-12-17 | Xen 4.6.x and earlier does not properly enforce limits on page order inputs for the (1) XENMEM_increase_reservation, (2) XENMEM_populate_physmap, (3) XENMEM_ex… | |
CVE-2015-7812 | | 2015-11-17 | The hypercall_create_continuation function in arch/arm/domain.c in Xen 4.4.x through 4.6.x allows local guest users to cause a denial of service (host crash) v… | |
CVE-2015-8104 | Critical | 10.0 | 2015-11-16 | The KVM subsystem in the Linux kernel through 4.2.6, and Xen 4.3.x through 4.6.x, allows guest OS users to cause a denial of service (host OS panic or hang) by… |
CVE-2015-5307 | | 2015-11-16 | The KVM subsystem in the Linux kernel through 4.2.6, and Xen 4.3.x through 4.6.x, allows guest OS users to cause a denial of service (host OS panic or hang) by… | |
CVE-2015-7972 | | 2015-10-30 | The (1) libxl_set_memory_target function in tools/libxl/libxl.c and (2) libxl__build_post function in tools/libxl/libxl_dom.c in Xen 3.4.x through 4.6.x do not… | |
CVE-2015-7971 | | 2015-10-30 | Xen 3.2.x through 4.6.x does not limit the number of printk console messages when logging certain pmu and profiling hypercalls, which allows local guests to ca… | |
CVE-2015-7970 | | 2015-10-30 | The p2m_pod_emergency_sweep function in arch/x86/mm/p2m-pod.c in Xen 3.4.x, 3.5.x, and 3.6.x is not preemptible, which allows local x86 HVM guest administrator… | |
CVE-2015-7969 | | 2015-10-30 | Multiple memory leaks in Xen 4.0 through 4.6.x allow local guest administrators or domains with certain permission to cause a denial of service (memory consump… | |
CVE-2015-7835 | | 2015-10-30 | The mod_l2_entry function in arch/x86/mm.c in Xen 3.4 through 4.6.x does not properly validate level 2 page table entries, which allows local PV guest administ… | |
CVE-2015-7814 | | 2015-10-30 | Race condition in the relinquish_memory function in arch/arm/domain.c in Xen 4.6.x and earlier allows local domains with partial management control to cause a… | |
CVE-2015-7813 | | 2015-10-30 | Xen 4.4.x, 4.5.x, and 4.6.x does not limit the number of printk console messages when reporting unimplemented hypercalls, which allows local guests to cause a… | |
CVE-2015-7311 | | 2015-10-01 | libxl in Xen 4.1.x through 4.6.x does not properly handle the readonly flag on disks when using the qemu-xen device model, which allows local guest users to wr… | |
CVE-2015-6654 | | 2015-09-03 | The xenmem_add_to_physmap_one function in arch/arm/mm.c in Xen 4.5.x, 4.4.x, and earlier does not limit the number of printk console messages when reporting a… | |
CVE-2015-5166 | | 2015-08-12 | Use-after-free vulnerability in QEMU in Xen 4.5.x and earlier does not completely unplug emulated block devices, which allows local HVM guest users to gain pri… | |
CVE-2015-5165 | | 2015-08-12 | The C+ mode offload emulation in the RTL8139 network card device model in QEMU, as used in Xen 4.5.x and earlier, allows remote attackers to read process heap… | |
CVE-2015-5154 | | 2015-08-12 | Heap-based buffer overflow in the IDE subsystem in QEMU, as used in Xen 4.5.x and earlier, when the container has a CDROM drive enabled, allows local guest use… | |
CVE-2015-3259 | | 2015-07-16 | Stack-based buffer overflow in the xl command line utility in Xen 4.1.x through 4.5.x allows local guest administrators to gain privileges via a long configura… | |
CVE-2015-4164 | | 2015-06-15 | The compat_iret function in Xen 3.1 through 4.5 iterates the wrong way through a loop, which allows local 32-bit PV guest administrators to cause a denial of s… | |
CVE-2015-4163 | | 2015-06-15 | GNTTABOP_swap_grant_ref in Xen 4.2 through 4.5 does not check the grant table operation version, which allows local guest domains to cause a denial of service… | |
CVE-2015-4105 | | 2015-06-03 | Xen 3.3.x through 4.5.x enables logging for PCI MSI-X pass-through error messages, which allows local x86 HVM guests to cause a denial of service (host disk co… | |
CVE-2015-4104 | | 2015-06-03 | Xen 3.3.x through 4.5.x does not properly restrict access to PCI MSI mask bits, which allows local x86 HVM guest users to cause a denial of service (unexpected… | |
CVE-2015-4103 | | 2015-06-03 | Xen 3.3.x through 4.5.x does not properly restrict write access to the host MSI message data field, which allows local x86 HVM guest administrators to cause a… | |
CVE-2015-3456 | | 2015-05-13 | The Floppy Disk Controller (FDC) in QEMU, as used in Xen 4.5.x and earlier and KVM, allows local guest users to cause a denial of service (out-of-bounds write… | |
CVE-2015-3340 | | 2015-04-28 | Xen 4.2.x through 4.5.x does not initialize certain fields, which allows certain remote service domains to obtain sensitive information from memory via a (1) X… | |
CVE-2015-0777 | | 2015-04-05 | drivers/xen/usbback/usbback.c in linux-2.6.18-xen-3.4.0 (aka the Xen 3.4.x support patches for the Linux kernel 2.6.18), as used in the Linux kernel 2.6.x and… | |
CVE-2015-2756 | | 2015-04-01 | QEMU, as used in Xen 3.3.x through 4.5.x, does not properly restrict access to PCI command registers, which might allow local HVM guest users to cause a denial… | |
CVE-2015-2752 | | 2015-04-01 | The XEN_DOMCTL_memory_mapping hypercall in Xen 3.2.x through 4.5.x, when using a PCI passthrough device, is not preemptible, which allows local x86 HVM domain… | |
CVE-2015-2751 | | 2015-04-01 | Xen 4.3.x, 4.4.x, and 4.5.x, when using toolstack disaggregation, allows remote domains with partial management control to cause a denial of service (host lock… | |
CVE-2015-2152 | | 2015-03-18 | Xen 4.5.x and earlier enables certain default backends when emulating a VGA device for an x86 HVM guest qemu even when the configuration disables them, which a… | |
CVE-2015-2151 | | 2015-03-12 | The x86 emulator in Xen 3.2.x through 4.5.x does not properly ignore segment overrides for instructions with register operands, which allows local guest users… | |
CVE-2015-2150 | | 2015-03-12 | Xen 3.3.x through 4.5.x and the Linux kernel through 3.19.1 do not properly restrict access to PCI command registers, which might allow local guest OS users to… | |
CVE-2015-2045 | | 2015-03-12 | The HYPERVISOR_xen_version hypercall in Xen 3.2.x through 4.5.x does not properly initialize data structures, which allows local guest users to obtain sensitiv… | |
CVE-2015-2044 | | 2015-03-12 | The emulation routines for unspecified X86 devices in Xen 3.2.x through 4.5.x does not properly initialize data, which allow local HVM guest users to obtain se… | |
CVE-2015-0268 | | 2015-02-16 | The vgic_v2_to_sgi function in arch/arm/vgic-v2.c in Xen 4.5.x, when running on ARM hardware with general interrupt controller (GIC) version 2, allows local gu… | |
CVE-2015-1563 | | 2015-02-09 | The ARM GIC distributor virtualization in Xen 4.4.x and 4.5.x allows local guests to cause a denial of service by causing a large number messages to be logged. | |
CVE-2014-6268 | | 2015-01-12 | The evtchn_fifo_set_pending function in Xen 4.4.x allows local guest users to cause a denial of service (host crash) via vectors involving an uninitialized FIF… | |
CVE-2015-0361 | | 2015-01-07 | Use-after-free vulnerability in Xen 4.2.x, 4.3.x, and 4.4.x allows remote domains to cause a denial of service (system crash) via a crafted hypercall during HV… |