CVE-2014-7188

The hvmmsrreadintercept function in arch/x86/hvm/hvm.c in Xen 4.1 through 4.4.x uses an improper MSR range for x2APIC emulation, which allows local HVM guests to cause a denial of service host crash or read data from the hypervisor or other guests via unspecified vectors...

CVE-2014-7156

The x86emulate function in arch/x86/x86emulate/x86emulate.c in Xen 3.3.x through 4.4.x does not check the supervisor mode permissions for instructions that generate software interrupts, which allows local HVM guest users to cause a denial of service guest crash via unspecified vectors...

Missing privilege level checks in x86 emulation of software interrupts

ISSUE DESCRIPTION The emulation of instructions which generate software interrupts fails to perform supervisor mode permission checks. However these instructions are not usually handled by the emulator. Exceptions to this are - when a memory operand implicit for the affected instructions lives in...

Missing privilege level checks in x86 HLT, LGDT, LIDT, and LMSW emulation

ISSUE DESCRIPTION The emulation of the instructions HLT, LGDT, LIDT, and LMSW fails to perform supervisor mode permission checks. However these instructions are not usually handled by the emulator. Exceptions to this are - when the instruction's memory operand if any lives in emulated or passed...

Race condition in HVMOP_track_dirty_vram

ISSUE DESCRIPTION The routine controlling the setup of dirty video RAM tracking latches the value of a pointer before taking the respective guarding lock, thus making it possible for a stale pointer to be used by the time the lock got acquired and the pointer gets dereferenced. The hypercall...

CVE-2014-5146

Certain MMU virtualization operations in Xen 4.2.x through 4.4.x before the xsa97-hap patch, when using Hardware Assisted Paging HAP, are not preemptible, which allows local HVM guest to cause a denial of service vcpu consumption by invoking these operations, which process every page assigned to ...

DEBIAN-CVE-2014-5146

Certain MMU virtualization operations in Xen 4.2.x through 4.4.x before the xsa97-hap patch, when using Hardware Assisted Paging HAP, are not preemptible, which allows local HVM guest to cause a denial of service vcpu consumption by invoking these operations, which process every page assigned to ...

CVE-2014-5149

Certain MMU virtualization operations in Xen 4.2.x through 4.4.x, when using shadow pagetables, are not preemptible, which allows local HVM guest to cause a denial of service vcpu consumption by invoking these operations, which process every page assigned to a guest, a different vulnerability tha...

Design/Logic Flaw

Certain MMU virtualization operations in Xen 4.2.x through 4.4.x, when using shadow pagetables, are not preemptible, which allows local HVM guest to cause a denial of service vcpu consumption by invoking these operations, which process every page assigned to a guest, a different vulnerability tha...

CVE-2014-5149

Certain MMU virtualization operations in Xen 4.2.x through 4.4.x, when using shadow pagetables, are not preemptible, which allows local HVM guest to cause a denial of service vcpu consumption by invoking these operations, which process every page assigned to a guest, a different vulnerability tha...

Long latency virtual-mmu operations are not preemptible

ISSUE DESCRIPTION Some MMU virtualization operations on HVM guests must process every page assigned to a guest. For larger guests, this can tie up a vcpu for a significant amount of time, as the operations are not preemptible. For guests using Hardware Assisted Paging HAP, see below this is...

CVE-2014-4947

Buffer overflow in the HVM graphics console support in Citrix XenServer 6.2 Service Pack 1 and earlier has unspecified impact and attack vectors...

Buffer overflow

Buffer overflow in the HVM graphics console support in Citrix XenServer 6.2 Service Pack 1 and earlier has unspecified impact and attack vectors...

Fedora 19 : xen-4.2.4-5.fc19 (2014-7408)

Vulnerabilities in HVM MSI injection Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 703...

Fedora 20 : xen-4.3.2-5.fc20 (2014-7423)

Fix %if line typo in the spec file, Vulnerabilities in HVM MSI injection Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing...

[oss-security] Xen Security Advisory 96 (CVE-2014-3967,CVE-2014-3968) - Vulnerabilities in HVM MSI injection

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Xen Security Advisory CVE-2014-3967,CVE-2014-3968 / XSA-96 version 3 Vulnerabilities in HVM MSI injection UPDATES IN VERSION 3 ==================== CVEs assigned. ISSUE DESCRIPTION ================= The implementation of the HVM control operation...

openSUSE Security Update : xen-201105 (openSUSE-SU-2011:0580-1)

Collective May/2011 update for Xen Xen : - 691238 - L3: question on behaviour change xm list - 623680 - xen kernel freezes during boot when processor module is loaded - 680824 - dom0 can't recognize boot disk when IOMMU is enabled - 688473 - VUL-0: potential buffer overflow in tools - 679344 -...

CVE-2014-3967

The HVMOPinjectmsi function in Xen 4.2.x, 4.3.x, and 4.4.x does not properly check the return value from the IRQ setup check, which allows local HVM guest administrators to cause a denial of service NULL pointer dereference and crash via unspecified vectors...

CVE-2014-3967

The CVE-2014-3967 vulnerability affects Xen 4.2.x, 4.3.x and 4.4.x. The root cause is that HVMOP_inject_msi does not properly validate the IRQ setup return value, enabling a local HVM guest administrator to trigger a denial of service via a NULL pointer dereference and crash. No explicit exploit ...

Vulnerabilities in HVM MSI injection

ISSUE DESCRIPTION The implementation of the HVM control operation HVMOPinjectmsi, while checking whether a particular IRQ was already set up in the necessary way, fails to properly check all respective conditions. In particular it doesn't check the returned pointer for being non-NULL before de-...