xen xen 4.6.0 vulnerabilities and exploits

(subscribe to this query)

VMX in Xen 4.6.x and previous versions, when using an Intel or Cyrix CPU, allows local HVM guest users to cause a denial of service (guest crash) via vectors related to a non-canonical RIP.

Xen Xen 4.6.0 Xen Xen 4.6.1

The hvm_set_callback_via function in arch/x86/hvm/irq.c in Xen 4.6 does not limit the number of printk console messages when logging the new callback method, which allows local HVM guest OS users to cause a denial of service via a large number of changes to the callback method (H...

Xen 4.4.x, 4.5.x, and 4.6.x does not limit the number of printk console messages when reporting unimplemented hypercalls, which allows local guests to cause a denial of service via a sequence of (1) HYPERVISOR_physdev_op hypercalls, which are not properly handled in the do_physde...

Xen Xen 4.4.0 Xen Xen 4.4.1 Xen Xen 4.5.0 Xen Xen 4.5.1 Xen Xen 4.6.0

1 Article

Xen up to and including 4.6.x on 64-bit platforms mishandles a failsafe callback, which might allow PV guest OS users to execute arbitrary code on the host OS, aka XSA-215.

Xen Xen 4.6.0 Xen Xen 4.6.1 Xen Xen 4.6.2 Xen Xen 4.6.3 Xen Xen 4.6.4 Xen Xen 4.6.5

1 Github repository

The hypercall_create_continuation function in arch/arm/domain.c in Xen 4.4.x up to and including 4.6.x allows local guest users to cause a denial of service (host crash) via a preemptible hypercall to the multicall interface.

Xen Xen 4.4.0 Xen Xen 4.4.1 Xen Xen 4.4.2 Xen Xen 4.4.3 Xen Xen 4.5.0 Xen Xen 4.5.1 Xen Xen 4.5.2 Xen Xen 4.6.0

Xen up to and including 4.8.x does not validate a vCPU array index upon the sending of an SGI, which allows guest OS users to cause a denial of service (hypervisor crash), aka XSA-225.

Xen Xen 4.6.0 Xen Xen 4.6.1 Xen Xen 4.6.2 Xen Xen 4.6.4 Xen Xen 4.6.5 Xen Xen 4.7.1 Xen Xen 4.8.0 Xen Xen 4.8.1

The p2m_teardown function in arch/arm/p2m.c in Xen 4.4.x up to and including 4.6.x allows local guest OS users with access to the driver domain to cause a denial of service (NULL pointer dereference and host OS crash) by creating concurrent domains and holding references to them,...

Xen Xen 4.4.0 Xen Xen 4.4.1 Xen Xen 4.4.2 Xen Xen 4.4.3 Xen Xen 4.4.4 Xen Xen 4.5.0 Xen Xen 4.5.1 Xen Xen 4.5.2 Xen Xen 4.5.3 Xen Xen 4.6.0 Xen Xen 4.6.1

The vCPU context-switch implementation in Xen up to and including 4.8.x improperly interacts with the Memory Protection Extensions (MPX) and Protection Key (PKU) features, which makes it easier for guest OS users to defeat ASLR and other protection mechanisms, aka XSA-220.

Xen Xen 4.5.0 Xen Xen 4.5.1 Xen Xen 4.5.2 Xen Xen 4.5.3 Xen Xen 4.5.5 Xen Xen 4.6.0 Xen Xen 4.6.1 Xen Xen 4.6.2 Xen Xen 4.6.4 Xen Xen 4.6.5 Xen Xen 4.7.1 Xen Xen 4.8.0

VMFUNC emulation in Xen 4.6.x up to and including 4.8.x on x86 systems using AMD virtualization extensions (aka SVM) allows local HVM guest OS users to cause a denial of service (hypervisor crash) by leveraging a missing NULL pointer check.

Xen Xen 4.6.0 Xen Xen 4.6.1 Xen Xen 4.6.3 Xen Xen 4.6.4 Xen Xen 4.7.0 Xen Xen 4.7.1 Xen Xen 4.8.0 Citrix Xenserver 6.0.2 Citrix Xenserver 6.2.0 Citrix Xenserver 6.5 Citrix Xenserver 7.0

Xen 4.6.x, 4.5.x, 4.4.x, 4.3.x, and previous versions do not initialize x86 FPU stack and XMM registers when XSAVE/XRSTOR are not used to manage guest extended register state, which allows local guest domains to obtain sensitive information from other domains via unspecified vect...

Citrix Xenserver 6.0 Xen Xen 4.3.0 Xen Xen 4.3.1 Xen Xen 4.3.2 Xen Xen 4.3.3 Xen Xen 4.3.4 Xen Xen 4.4.0 Xen Xen 4.4.1 Xen Xen 4.4.2 Xen Xen 4.4.3 Xen Xen 4.4.4 Xen Xen 4.5.0

1 2 3 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Product List Vendor List Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook