CVE-2016-9637

The 1 ioportread and 2 ioportwrite functions in Xen, when qemu is used as a device model within Xen, might allow local x86 HVM guest OS administrators to gain qemu process privileges via vectors involving an out-of-range ioport access...

UBUNTU-CVE-2016-9637

The 1 ioportread and 2 ioportwrite functions in Xen, when qemu is used as a device model within Xen, might allow local x86 HVM guest OS administrators to gain qemu process privileges via vectors involving an out-of-range ioport access...

CVE-2016-9637

CVE-2016-9637 affects Xen when qemu is used as a device model; the ioport_read/ioport_write paths can mishandle a 32-bit ioport address, enabling a local x86 HVM guest administrator to escalate privileges to the qemu process due to out-of-range ioport access. The issue is tied to out-of-bounds ar...

WNC01WH vulnerable to denial-of-service (DoS)

Overview WNC01WH provided by BUFFALO INC. is a network camera. WNC01WH contains a denial-of-service DoS vulnerability. Toshitsugu Yoneyama of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning...

FreeBSD : xen-kernel -- ioreq handling possibly susceptible to multiple read issue (6aa2d135-b40e-11e5-9728-002590263bf5)

The Xen Project reports : Single memory accesses in source code can be translated to multiple ones in machine code by the compiler, requiring special caution when accessing shared memory. Such precaution was missing from the hypervisor code inspecting the state of I/O requests sent to the device...

ioreq handling possibly susceptible to multiple read issue

ISSUE DESCRIPTION Single memory accesses in source code can be translated to multiple ones in machine code by the compiler, requiring special caution when accessing shared memory. Such precaution was missing from the hypervisor code inspecting the state of I/O requests sent to the device model fo...

xen-kernel -- ioreq handling possibly susceptible to multiple read issue

The Xen Project reports: Single memory accesses in source code can be translated to multiple ones in machine code by the compiler, requiring special caution when accessing shared memory. Such precaution was missing from the hypervisor code inspecting the state of I/O requests sent to the device...

FreeBSD : xen-tools -- libxl fails to honour readonly flag on disks with qemu-xen (301b04d7-881c-11e5-ab94-002590263bf5)

"The Xen Project reports : Callers of libxl can specify that a disk should be read-only to the guest. However, there is no code in libxl to pass this information to qemu-xen the upstream-based qemu %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in thi...

CVE-2015-7311

CVE-2015-7311 affects Xen’s libxl when using the qemu-xen device model; Xen 4.1.x–4.6.x did not properly enforce the readonly flag on disks, allowing local guest users to write to a read-only disk image. Public advisories (GLSA-2016-04, openSUSE/SUSE advisories) list this vulnerability among seve...

libxl fails to honour readonly flag on disks with qemu-xen

ISSUE DESCRIPTION Callers of libxl can specify that a disk should be read-only to the guest. However, there is no code in libxl to pass this information to qemu-xen the upstream-based qemu; and indeed there is no way in qemu to make a disk read-only. The vulnerability is exploitable only via...

Xen XEN_DOMCTL_memory_mapping hypercall local denial of service vulnerability

Xen is a virtualization technology for the Linux kernel that allows multiple operating systems to run simultaneously. A security vulnerability in Xen XENDOMCTLmemorymapping hypercall allows local X86 HVM domain users to conduct denial-of-service attacks via special device model requests when usin...

CVE-2015-2752

The XENDOMCTLmemorymapping hypercall in Xen 3.2.x through 4.5.x, when using a PCI passthrough device, is not preemptible, which allows local x86 HVM domain users to cause a denial of service host CPU consumption via a crafted request to the device model qemu-dm...

Cross site request forgery (csrf)

The XENDOMCTLmemorymapping hypercall in Xen 3.2.x through 4.5.x, when using a PCI passthrough device, is not preemptible, which allows local x86 HVM domain users to cause a denial of service host CPU consumption via a crafted request to the device model qemu-dm...

OracleVM 3.0 : xen (OVMSA-2012-0020)

The remote OracleVM system is missing necessary patches to address critical security updates : - x86-64: detect processors subject to AMD erratum 121 and refuse to bootCVE-2006-0744 - guest denial of service on syscall/sysenter exception generation CVE-2012-0217 - Remove unnecessary balloon retri...

Cisco NX-OS Detection (SSH Login)

SSH login-based detection of Cisco NX-OS. Copyright C 2013 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribut...

libxl partially sets up HVM passthrough even with disabled iommu

ISSUE DESCRIPTION With HVM domains, libxl's setup of PCI passthrough devices does the IOMMU setup after giving via the device model the guest access to the hardware and advertising it to the guest. If the IOMMU is disabled the overall setup fails, but after the device has been made available to t...

CVE-2012-3515

Qemu, as used in Xen 4.0, 4.1 and possibly other products, when emulating certain devices with a virtual console backend, allows local OS guest users to gain privileges via a crafted escape VT100 sequence that triggers the overwrite of a "device model's address space."...

Debian DSA-2543-1 : xen-qemu-dm-4.0 - multiple vulnerabilities

Multiple vulnerabilities have been discovered in xen-qemu-dm-4.0, the Xen QEMU Device Model virtual machine hardware emulator. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2012-3515 : The device model for HVM domains does not properly handle VT100...

DSA-2543-1 xen-qemu-dm-4.0 - multiple

Bulletin has no description...

qemu: VT100 emulation vulnerability

Qemu, as used in Xen 4.0, 4.1 and possibly other products, when emulating certain devices with a virtual console backend, allows local OS guest users to gain privileges via a crafted escape VT100 sequence that triggers the overwrite of a "device model's address space."...