ALPINE-CVE-2017-8903

Xen through 4.8.x on 64-bit platforms mishandles page tables after an IRET hypercall, which might allow PV guest OS users to execute arbitrary code on the host OS, aka XSA-213...

[SECURITY] Fedora 26 Update: xen-4.8.1-2.fc26

This package contains the XenD daemon and xm command line tools, needed to manage virtual machines running under the Xen hypervisor...

openSUSE Security Update : xen (openSUSE-2017-492)

This update for xen to version 4.7.2 fixes the following issues : These security issues were fixed : - CVE-2017-7228: Broken check in memoryexchange permited PV guest breakout bsc1030442. - XSA-206: Unprivileged guests issuing writes to xenstore were able to stall progress of the control domain o...

[SECURITY] Fedora 24 Update: xen-4.6.5-5.fc24

This package contains the XenD daemon and xm command line tools, needed to manage virtual machines running under the Xen hypervisor...

Xen Hypervisor XENMEM_exchange Memory Disclosure (XSA-212)

According to its self-reported version number, the Xen hypervisor installed on the remote host is affected by an out-of-array memory access error in the memoryexchange function in file common/memory.c due to improper checking of XENMEMexchange input. An attacker on a 64-bit PV guest VM who has...

Xen Hypervisor xenstored Write Saturation DoS (XSA-206)

According to its self-reported version number, the Xen hypervisor installed on the remote host is affected by a denial of service vulnerability in xenstored during processing of transactions. An attacker on the guest can exploit this vulnerability by issuing repeated writes to xenstore that...

[SECURITY] Fedora 25 Update: xen-4.7.2-5.fc25

This package contains the XenD daemon and xm command line tools, needed to manage virtual machines running under the Xen hypervisor...

Pandavirtualization: Exploiting the Xen hypervisor

Posted by Jann Horn, Project Zero On 2017-03-14, I reported a bug to Xen's security team that permits an attacker with control over the kernel of a paravirtualized x86-64 Xen guest to break out of the hypervisor and gain full control over the machine's physical memory. The Xen Project publicly...

[SECURITY] Fedora 25 Update: xen-4.7.2-4.fc25

This package contains the XenD daemon and xm command line tools, needed to manage virtual machines running under the Xen hypervisor...

ALPINE-CVE-2017-7228

An issue known as XSA-212 was discovered in Xen, with fixes available for 4.8.x, 4.7.x, 4.6.x, 4.5.x, and 4.4.x. The earlier XSA-29 fix introduced an insufficient check on XENMEMexchange input, allowing the caller to drive hypervisor memory accesses outside of the guest provided input/output arra...

[SECURITY] Fedora 25 Update: xen-4.7.2-2.fc25

This package contains the XenD daemon and xm command line tools, needed to manage virtual machines running under the Xen hypervisor...

[SECURITY] Fedora 24 Update: xen-4.6.4-8.fc24

This package contains the XenD daemon and xm command line tools, needed to manage virtual machines running under the Xen hypervisor...

[SECURITY] Fedora 25 Update: xen-4.7.1-9.fc25

This package contains the XenD daemon and xm command line tools, needed to manage virtual machines running under the Xen hypervisor...

ALPINE-CVE-2016-9815

Xen through 4.7.x allows local ARM guest OS users to cause a denial of service host panic by sending an asynchronous abort...

DEBIAN-CVE-2016-9818

Xen through 4.7.x allows local ARM guest OS users to cause a denial of service host crash via vectors involving an asynchronous abort while at HYP...

[SECURITY] Fedora 24 Update: xen-4.6.4-7.fc24

This package contains the XenD daemon and xm command line tools, needed to manage virtual machines running under the Xen hypervisor...

Xen Guest Destruction Memory Leak DoS (XSA-207)

According to its self-reported version number, the Xen hypervisor installed on the remote host is missing a security update. It is, therefore, affected by a memory leak issue due to improper cleanup during guest destruction. A guest attacker can exploit this issue, via frequent rebooting, to...

[SECURITY] Fedora 25 Update: xen-4.7.1-8.fc25

This package contains the XenD daemon and xm command line tools, needed to manage virtual machines running under the Xen hypervisor...

[SECURITY] Fedora 25 Update: xen-4.7.1-7.fc25

This package contains the XenD daemon and xm command line tools, needed to manage virtual machines running under the Xen hypervisor...

Xen SYSCALL singlestep Handling Privilege Escalation (XSA-204)

According to its self-reported version number, the Xen hypervisor installed on the remote host is missing a security update. It is, therefore, affected by a privilege elevation vulnerability in the instruction emulator when handling SYSCALL by single-stepping applications. This is due to incorrec...