UBUNTU-CVE-2017-10920

The grant-table feature in Xen through 4.8.x mishandles a GNTMAPdevicemap and GNTMAPhostmap mapping, when followed by only a GNTMAPhostmap unmapping, which allows guest OS users to cause a denial of service count mismanagement and memory corruption or obtain privileged host OS access, aka XSA-224...

CVE-2017-10919

Xen through 4.8.x mishandles virtual interrupt injection, which allows guest OS users to cause a denial of service hypervisor crash, aka XSA-223...

Null pointer dereference

Xen through 4.8.x does not validate the port numbers of polled event channel ports, which allows guest OS users to cause a denial of service NULL pointer dereference and host OS crash or possibly obtain sensitive information, aka XSA-221...

CVE-2017-10914

CVE-2017-10914 affects Xen (grant-table feature) through 4.8.x due to a race condition in grant handling that can cause a double free. Impact includes denial of service (memory consumption) and potential information disclosure or privilege escalation. Based on the sources, exploitability depends ...

CVE-2017-10913

CVE-2017-10913 affects the Xen hypervisor grant-table handling up to 4.8.x. The vulnerability arises from concurrent unmap calls causing false grant mappings, enabling backend attackers to read sensitive data or escalate privileges (XSA-218 bug 1). Impact shown in multiple advisories; patches/wor...

CVE-2017-10915

The shadow-paging feature in Xen through 4.8.x mismanages page references and consequently introduces a race condition, which allows guest OS users to obtain Xen privileges, aka XSA-219...

CVE-2017-10920

CVE-2017-10920 affects Xen up to 4.8.x, where grant-table GNTMAP_device_map and GNTMAP_host_map handling is flawed. If followed by only a GNTMAP_host_map unmapping, guest OS users can cause a denial of service (count mismanagement, memory corruption) or obtain privileged host OS access (XSA-224 b...

Xen has an unspecified vulnerability

Xen is an open source virtual machine monitor product developed at the University of Cambridge, UK. The product enables different and incompatible operating systems to run on the same computer and supports runtime migration to ensure uptime and avoid downtime. A security vulnerability exists in X...

CVE-2017-8903

Xen through 4.8.x on 64-bit platforms mishandles page tables after an IRET hypercall, which might allow PV guest OS users to execute arbitrary code on the host OS, aka XSA-213...

CVE-2017-8904

CVE-2017-8904 : Xen up to 4.8.x is affected by a flaw in the handling of the “contains segment descriptors” property during GNTTABOP_transfer (guest transfer). The underlying issue is the mishandling in guest transfer operations, which could allow a PV guest OS user to execute arbitrary code on t...

CVE-2017-8904

Xen through 4.8.x mishandles the "contains segment descriptors" property during GNTTABOPtransfer aka guest transfer operations, which might allow PV guest OS users to execute arbitrary code on the host OS, aka XSA-214...

CVE-2016-1561

ExaGrid appliances with firmware before 4.8 P26 have a default SSH public key in the authorizedkeys file for root, which allows remote attackers to obtain SSH access by leveraging knowledge of a private key from another installation or a firmware image...

CVE-2017-7228

An issue known as XSA-212 was discovered in Xen, with fixes available for 4.8.x, 4.7.x, 4.6.x, 4.5.x, and 4.4.x. The earlier XSA-29 fix introduced an insufficient check on XENMEMexchange input, allowing the caller to drive hypervisor memory accesses outside of the guest provided input/output arra...

Input validation

An issue known as XSA-212 was discovered in Xen, with fixes available for 4.8.x, 4.7.x, 4.6.x, 4.5.x, and 4.4.x. The earlier XSA-29 fix introduced an insufficient check on XENMEMexchange input, allowing the caller to drive hypervisor memory accesses outside of the guest provided input/output arra...

CVE-2017-7228

An issue known as XSA-212 was discovered in Xen, with fixes available for 4.8.x, 4.7.x, 4.6.x, 4.5.x, and 4.4.x. The earlier XSA-29 fix introduced an insufficient check on XENMEMexchange input, allowing the caller to drive hypervisor memory accesses outside of the guest provided input/output arra...

UBUNTU-CVE-2017-5546

The freelist-randomization feature in mm/slab.c in the Linux kernel 4.8.x and 4.9.x before 4.9.5 allows local users to cause a denial of service duplicate freelist entries and system crash or possibly have unspecified other impact in opportunistic circumstances by leveraging the selection of a...

CVE-2016-10024

Xen through 4.8.x allows local x86 PV guest OS kernel administrators to cause a denial of service host hang or crash by modifying the instruction stream asynchronously while performing certain kernel operations...

ALPINE-CVE-2016-10024

Xen through 4.8.x allows local x86 PV guest OS kernel administrators to cause a denial of service host hang or crash by modifying the instruction stream asynchronously while performing certain kernel operations...

Design/Logic Flaw

Xen through 4.8.x allows local 64-bit x86 HVM guest OS users to gain privileges by leveraging mishandling of SYSCALL singlestep during emulation...

Null pointer dereference

VMFUNC emulation in Xen 4.6.x through 4.8.x on x86 systems using AMD virtualization extensions aka SVM allows local HVM guest OS users to cause a denial of service hypervisor crash by leveraging a missing NULL pointer check...