CVE-2017-10921

CVE-2017-10921 affects the Xen hypervisor grant-table operations in Xen up to 4.8.x, where insufficient type counts for GNTMAP_device_map and GNTMAP_host_map can lead to count mismanagement, memory corruption, DoS, or privilege escalation to the host. Debian DLA-1132 documents the issue and notes...

CVE-2017-10913

CVE-2017-10913 affects the Xen hypervisor grant-table handling up to 4.8.x. The vulnerability arises from concurrent unmap calls causing false grant mappings, enabling backend attackers to read sensitive data or escalate privileges (XSA-218 bug 1). Impact shown in multiple advisories; patches/wor...

Xen grant-table function denial of service vulnerability (CNVD-2017-21747)

Xen is an open source virtual machine monitor product developed at the University of Cambridge in the United Kingdom. A security vulnerability in the Xen grant-table feature allows an attacker to exploit the vulnerability by submitting a special request to crash the system...

Xen grant-table feature race condition vulnerability

Xen is an open source virtual machine monitor product developed at the University of Cambridge in the United Kingdom. A competitive condition vulnerability exists in the Xengrant-table feature that allows attackers to conduct denial-of-service attacks that can be exploited to crash a system...

Xen has multiple vulnerabilities (CNVD-2017-21732)

Xen is an open source virtual machine monitor product developed at the University of Cambridge, UK. The product enables different and incompatible operating systems to run on the same computer and supports runtime migration to ensure uptime and avoid downtime. A security vulnerability exists in t...

Xen grant-table feature denial-of-service vulnerability

Xen is an open source virtual machine monitor product developed at the University of Cambridge in the United Kingdom. A security vulnerability in the Xen grant-table feature allows an attacker to exploit the vulnerability by submitting a special request to crash the system...

Xen grant-table function denial of service vulnerability (CNVD-2017-21748)

Xen is an open source virtual machine monitor product developed at the University of Cambridge in the United Kingdom. The Xen grant-table feature fails to properly handle the mapping of GNTMAPdevicemap and GNTMAPhostmap, allowing an attacker to exploit a vulnerability by submitting a special...

Citrix XenServer Multiple Vulnerabilities (CTX224740)

The version of Citrix XenServer installed on the remote host is missing a security hotfix. It is, therefore, affected by multiple vulnerabilities : - A flaw exists that causes grant table operations to fail due to improper handling of reference counts. An unauthenticated, remote attacker can...

grant table operations mishandle reference counts

ISSUE DESCRIPTION We have discovered a number of bugs in the code mapping and unmapping grant references. If a grant is mapped with both the GNTMAPdevicemap and GNTMAPhostmap flags, but unmapped only with hostmap, the devicemap portion remains but the page reference counts are lowered as though i...

Xen Code Execution Vulnerability

Xen is an open source virtual machine monitor product developed at the University of Cambridge, UK. The product enables different and incompatible operating systems to run on the same computer and supports runtime migration to ensure uptime and avoid downtime. A security vulnerability exists in X...

DEBIAN-CVE-2015-4163

GNTTABOPswapgrantref in Xen 4.2 through 4.5 does not check the grant table operation version, which allows local guest domains to cause a denial of service NULL pointer dereference via a hypercall without a GNTTABOPsetuptable or GNTTABOPsetversion...

UBUNTU-CVE-2015-4163

GNTTABOPswapgrantref in Xen 4.2 through 4.5 does not check the grant table operation version, which allows local guest domains to cause a denial of service NULL pointer dereference via a hypercall without a GNTTABOPsetuptable or GNTTABOPsetversion...

CVE-2015-4163

GNTTABOPswapgrantref in Xen 4.2 through 4.5 does not check the grant table operation version, which allows local guest domains to cause a denial of service NULL pointer dereference via a hypercall without a GNTTABOPsetuptable or GNTTABOPsetversion...

xen-kernel -- GNTTABOP_swap_grant_ref operation misbehavior

The Xen Project reports: With the introduction of version 2 grant table operations, a version check became necessary for most grant table related hypercalls. The GNTTABOPswapgrantref call was lacking such a check. As a result, the subsequent code behaved as if version 2 was in use, when a guest...

UBUNTU-CVE-2014-4022

The allocdomainstruct function in arch/arm/domain.c in Xen 4.4.x, when running on an ARM platform, does not properly initialize the structure containing the grant table pages for a domain, which allows local guest administrators to obtain sensitive information via the GNTTABOPsetuptable...

information leak via gnttab_setup_table on ARM

ISSUE DESCRIPTION When initialising an internal data structure on ARM platform Xen was not correctly initialising the memory containing the list of a domain's grant table pages. This list is returned by the GNTTABOPsetuptable subhypercall, leading to an information leak. IMPACT Malicious guest...

openSUSE Security Update : XEN (openSUSE-SU-2012:1572-1)

This security update of XEN fixes various bugs and security issues. - Upstream patch 26088-xend-xml-filesize-check.patch - bnc787163 - CVE-2012-4544: xen: Domain builder Out-of- memory due to malicious kernel/ramdisk XSA 25 CVE-2012-4544-xsa25.patch - bnc779212 - CVE-2012-4411: XEN / qemu: guest...

kernel: xen: Lock order reversal between page allocation and grant table locks

Xen before 4.1.x, 4.2.x, and 4.3.x does not take the pagealloclock and granttable.lock in the same order, which allows local guest administrators with access to multiple vcpus to cause a denial of service host deadlock via unspecified vectors...

SuSE 11.2 Security Update : Xen (SAT Patch Number 8577)

Xen has been updated to fix a security issue and a bug : - XSA-73: A lock order reversal between page allocation and grant table locks could lead to host crashes or even host code execution. CVE-2013-4494 A non-security bug has also been fixed : - It is possible to start a VM twice on the same no...

Fedora 18 : xen-4.2.3-7.fc18 (2013-20544)

Lock order reversal between page allocation and grant table locks ocaml xenstored mishandles oversized message replies systemd changes to allow oxenstored to be used instead of xenstored Note that Tenable Network Security has extracted the preceding description block directly from the Fedora...