CVE-2017-10921

The grant-table feature in Xen through 4.8.x does not ensure sufficient type counts for a GNTMAPdevicemap and GNTMAPhostmap mapping, which allows guest OS users to cause a denial of service count mismanagement and memory corruption or obtain privileged host OS access, aka XSA-224 bug 2...

CVE-2017-10913

CVE-2017-10913 affects the Xen hypervisor grant-table handling up to 4.8.x. The vulnerability arises from concurrent unmap calls causing false grant mappings, enabling backend attackers to read sensitive data or escalate privileges (XSA-218 bug 1). Impact shown in multiple advisories; patches/wor...

CVE-2017-10920

CVE-2017-10920 affects Xen up to 4.8.x, where grant-table GNTMAP_device_map and GNTMAP_host_map handling is flawed. If followed by only a GNTMAP_host_map unmapping, guest OS users can cause a denial of service (count mismanagement, memory corruption) or obtain privileged host OS access (XSA-224 b...

CVE-2017-10922

CVE-2017-10922 affects Xen’s grant-table feature. The grant-table MMIO region grant references are mishandled in Xen up to 4.8.x, enabling guest OS users to cause a denial of service (loss of grant trackability). This is part of XSA-224 (bug 3). Documented impact is a DoS; no exploitation method ...

CVE-2017-10913

The grant-table feature in Xen through 4.8.x provides false mapping information in certain cases of concurrent unmap calls, which allows backend attackers to obtain sensitive information or gain privileges, aka XSA-218 bug 1...

CVE-2017-10914

The grant-table feature in Xen through 4.8.x has a race condition leading to a double free, which allows guest OS users to cause a denial of service memory consumption, or possibly obtain sensitive information or gain privileges, aka XSA-218 bug 2...

CVE-2017-10922

The grant-table feature in Xen through 4.8.x mishandles MMIO region grant references, which allows guest OS users to cause a denial of service loss of grant trackability, aka XSA-224 bug 3...

CVE-2017-10920

The grant-table feature in Xen through 4.8.x mishandles a GNTMAPdevicemap and GNTMAPhostmap mapping, when followed by only a GNTMAPhostmap unmapping, which allows guest OS users to cause a denial of service count mismanagement and memory corruption or obtain privileged host OS access, aka XSA-224...

CVE-2017-10913

The grant-table feature in Xen through 4.8.x provides false mapping information in certain cases of concurrent unmap calls, which allows backend attackers to obtain sensitive information or gain privileges, aka XSA-218 bug 1...

CVE-2017-10920

The grant-table feature in Xen through 4.8.x mishandles a GNTMAPdevicemap and GNTMAPhostmap mapping, when followed by only a GNTMAPhostmap unmapping, which allows guest OS users to cause a denial of service count mismanagement and memory corruption or obtain privileged host OS access, aka XSA-224...

CVE-2017-10921

The grant-table feature in Xen through 4.8.x does not ensure sufficient type counts for a GNTMAPdevicemap and GNTMAPhostmap mapping, which allows guest OS users to cause a denial of service count mismanagement and memory corruption or obtain privileged host OS access, aka XSA-224 bug 2...

CVE-2017-10914

The grant-table feature in Xen through 4.8.x has a race condition leading to a double free, which allows guest OS users to cause a denial of service memory consumption, or possibly obtain sensitive information or gain privileges, aka XSA-218 bug 2...

CVE-2017-10922

The grant-table feature in Xen through 4.8.x mishandles MMIO region grant references, which allows guest OS users to cause a denial of service loss of grant trackability, aka XSA-224 bug 3...

Xen has multiple vulnerabilities (CNVD-2017-21732)

Xen is an open source virtual machine monitor product developed at the University of Cambridge, UK. The product enables different and incompatible operating systems to run on the same computer and supports runtime migration to ensure uptime and avoid downtime. A security vulnerability exists in t...

Xen grant-table function denial of service vulnerability (CNVD-2017-21748)

Xen is an open source virtual machine monitor product developed at the University of Cambridge in the United Kingdom. The Xen grant-table feature fails to properly handle the mapping of GNTMAPdevicemap and GNTMAPhostmap, allowing an attacker to exploit a vulnerability by submitting a special...

Xen grant-table feature denial-of-service vulnerability

Xen is an open source virtual machine monitor product developed at the University of Cambridge in the United Kingdom. A security vulnerability in the Xen grant-table feature allows an attacker to exploit the vulnerability by submitting a special request to crash the system...

Xen grant-table feature race condition vulnerability

Xen is an open source virtual machine monitor product developed at the University of Cambridge in the United Kingdom. A competitive condition vulnerability exists in the Xengrant-table feature that allows attackers to conduct denial-of-service attacks that can be exploited to crash a system...

Xen grant-table function denial of service vulnerability (CNVD-2017-21747)

Xen is an open source virtual machine monitor product developed at the University of Cambridge in the United Kingdom. A security vulnerability in the Xen grant-table feature allows an attacker to exploit the vulnerability by submitting a special request to crash the system...

Citrix XenServer Multiple Vulnerabilities (CTX224740)

The version of Citrix XenServer installed on the remote host is missing a security hotfix. It is, therefore, affected by multiple vulnerabilities : - A flaw exists that causes grant table operations to fail due to improper handling of reference counts. An unauthenticated, remote attacker can...

grant table operations mishandle reference counts

ISSUE DESCRIPTION We have discovered a number of bugs in the code mapping and unmapping grant references. If a grant is mapped with both the GNTMAPdevicemap and GNTMAPhostmap flags, but unmapped only with hostmap, the devicemap portion remains but the page reference counts are lowered as though i...