CVE-2017-8903

CVE-2017-8903 affects Xen on 64-bit platforms (Xen through 4.8.x) where page tables are mishandled after an IRET hypercall. This could let a PV guest OS user execute arbitrary code on the host OS (XSA-213). Connected sources corroborate the body of the vulnerability (XSA-213) and describe the hos...

CVE-2017-8903

Xen through 4.8.x on 64-bit platforms mishandles page tables after an IRET hypercall, which might allow PV guest OS users to execute arbitrary code on the host OS, aka XSA-213...

Xen Hypervisor Multiple Vulnerabilities (XSA-213 - XSA-215)

According to its self-reported version number, the Xen hypervisor installed on the remote host is affected by multiple vulnerabilities : - An information disclosure vulnerability exists in the getuser function due to permissions for accessing MMIO ranges being checked only after accessing them. A...

FreeBSD : xen-kernel -- vulnerability in the iret hypercall handler (8c31b288-27ec-11e5-a4a5-002590263bf5)

The Xen Project reports : A buggy loop in Xen's compatiret function iterates the wrong way around a 32-bit index. Any 32-bit PV guest kernel can trigger this vulnerability by attempting a hypercalliret with EFLAGS.VM set. Given the use of get/putuser, and that the virtual addresses in question ar...

Fedora 22 : xen-4.5.0-11.fc22 (2015-10001)

stubs-32.h is back, so revert to previous behaviour. Heap overflow in QEMU PCNET controller, allowing guest-host escape XSA-135, CVE-2015-3209. GNTTABOPswapgrantref operation misbehavior XSA-134, CVE-2015-4163. vulnerability in the iret hypercall handler XSA-136, CVE-2015-4164. Note that Tenable...

Fedora 20 : xen-4.3.4-6.fc20 (2015-9965)

Heap overflow in QEMU PCNET controller, allowing guest-host escape XSA-135, CVE-2015-3209 1230537 GNTTABOPswapgrantref operation misbehavior XSA-134, CVE-2015-4163 vulnerability in the iret hypercall handler XSA-136, CVE-2015-4164 Potential unintended writes to host MSI message data field via qem...

Security update for xen (important)

Xen was updated to fix eight vulnerabilities. The following vulnerabilities were fixed: CVE-2015-2751: Certain domctl operations may be abused to lock up the host XSA-127 boo922709 CVE-2015-4103: Potential unintended writes to host MSI message data field via qemu XSA-128 boo931625 CVE-2015-4104:...

[SECURITY] [DSA 3286-1] xen security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-3286-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff June 13, 2015 https://www.debian.org/security/faq -...

Debian DSA-3286-1 : xen - security update

Multiple security issues have been found in the Xen virtualisation solution : - CVE-2015-3209 Matt Tait discovered a flaw in the way QEMU's AMD PCnet Ethernet emulation handles multi-TMD packets with a length above 4096 bytes. A privileged guest user in a guest with an AMD PCNet ethernet card...

DSA-3286-1 xen - security update

Bulletin has no description...

Citrix XenServer Multiple Security Updates (CTX201145)

A number of security vulnerabilities have been identified in Citrix XenServer that may allow a malicious administrator of a guest VM to crash the host. These vulnerabilities affect all currently supported versions of Citrix XenServer up to and including Citrix XenServer 6.5 Service Pack 1...

xen-kernel -- vulnerability in the iret hypercall handler

The Xen Project reports: A buggy loop in Xen's compatiret function iterates the wrong way around a 32-bit index. Any 32-bit PV guest kernel can trigger this vulnerability by attempting a hypercalliret with EFLAGS.VM set. Given the use of get/putuser, and that the virtual addresses in question are...