CVE-2016-9382

Xen 4.0.x through 4.7.x mishandle x86 task switches to VM86 mode, which allows local 32-bit x86 HVM guest OS users to gain privileges or cause a denial of service guest OS crash by leveraging a guest operating system that uses hardware task switching and allows a new task to start in VM86 mode...

CVE-2016-9386

The x86 emulator in Xen does not properly treat x86 NULL segments as unusable when accessing memory, which might allow local HVM guest users to gain privileges via vectors involving "unexpected" base/limit values...

CVE-2016-9382

CVE-2016-9382 affects Xen 4.0.x–4.7.x and is caused by mishandling x86 task switches to VM86 mode. Local 32-bit x86 HVM guests can either escalate privileges or cause a guest crash/DoS by leveraging hardware task switching and allowing a new task to start in VM86 mode. Public references describe ...

CVE-2016-9381: Concurrent Execution using Shared Resource with Improper Synchronization

Race condition in QEMU in Xen allows local x86 HVM guest OS administrators to gain privileges by changing certain data on shared rings, aka a "double fetch" vulnerability...

CVE-2016-9386: Undefined Security Weakness

The x86 emulator in Xen does not properly treat x86 NULL segments as unusable when accessing memory, which might allow local HVM guest users to gain privileges via vectors involving "unexpected" base/limit values...

CVE-2016-9381

Race condition in QEMU in Xen allows local x86 HVM guest OS administrators to gain privileges by changing certain data on shared rings, aka a "double fetch" vulnerability...

x86: missing NULL pointer check in VMFUNC emulation

ISSUE DESCRIPTION When support for the Intel VMX VMFUNC leaf 0 was added, a new optional function pointer hvmemulvmfunc was added to the hvmemulateops table. As is intended, that new function pointer is NULL on non-VMX hardware, including AMD SVM hardware. However at a call site, the necessary NU...

PT-2017-7699

Name of the Vulnerable Software and Affected Versions Xen versions prior to 4.9 Description The issue allows local 64-bit x86 HVM guest OS users to gain privileges by leveraging mishandling of SYSCALL singlestep during emulation. Recommendations For versions prior to 4.9, update to version 4.9 or...

x86: Mishandling of SYSCALL singlestep during emulation

ISSUE DESCRIPTION The typical behaviour of singlestepping exceptions is determined at the start of the instruction, with a DB trap being raised at the end of the instruction. SYSCALL and SYSRET, although we don't implement it behave differently because the typical behaviour allows userspace to...

CVE-2016-9932

CMPXCHG8B emulation in Xen 3.3.x through 4.7.x on x86 systems allows local HVM guest OS users to obtain sensitive information from host stack memory via a "supposedly-ignored" operand size prefix...

x86 CMPXCHG8B emulation fails to ignore operand size override

ISSUE DESCRIPTION The x86 instruction CMPXCHG8B is supposed to ignore legacy operand size overrides; it only honors the REX.W override making it CMPXCHG16B. So, the operand size is always 8 or 16. When support for CMPXCHG16B emulation was added to the instruction emulator, this restriction on the...

Debian DSA-3729-1 : xen - security update

Multiple vulnerabilities have been discovered in the Xen hypervisor. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2016-7777 XSA-190 Jan Beulich from SUSE discovered that Xen does not properly honor CR0.TS and CR0.EM for x86 HVM guests, potentially...

PT-2017-10099

Name of the Vulnerable Software and Affected Versions QEMU in Xen affected versions not specified Description A race condition exists, allowing local x86 HVM guest OS administrators to gain privileges by changing certain data on shared rings. This issue is related to a "double fetch" vulnerabilit...

PT-2017-10229

Name of the Vulnerable Software and Affected Versions Xen affected versions not specified Description The issue involves the ioport read and ioport write functions in Xen when qemu is used as a device model. It might allow local x86 HVM guest OS administrators to gain qemu process privileges via...

qemu ioport array overflow

ISSUE DESCRIPTION The code in qemu which implements ioport read/write looks up the specified ioport address in a dispatch table. The argument to the dispatch function is a uint32t, and is used without a range check, even though the table has entries for only 2^16 ioports. When qemu is used as a...

FreeBSD : xen-kernel -- x86 HVM: Overflow of sh_ctxt->seg_reg[] (4aae54be-ba4d-11e6-ae1b-002590263bf5)

The Xen Project reports : x86 HVM guests running with shadow paging use a subset of the x86 emulator to handle the guest writing to its own pagetables. There are situations a guest can provoke which result in exceeding the space allocated for internal state. A malicious HVM guest administrator ca...

FreeBSD : xen-kernel -- CR0.TS and CR0.EM not always honored for x86 HVM guests (4d7cf654-ba4d-11e6-ae1b-002590263bf5)

The Xen Project reports : Instructions touching FPU, MMX, or XMM registers are required to raise a Device Not Available Exception NM when either CR0.EM or CR0.TS are set. Their AVX or AVX-512 extensions would consider only CR0.TS. While during normal operation this is ensured by the hardware, if ...

FreeBSD : xen-kernel -- x86: Mishandling of instruction pointer truncation during emulation (49211361-ba4d-11e6-ae1b-002590263bf5)

The Xen Project reports : When emulating HVM instructions, Xen uses a small i-cache for fetches from guest memory. The code that handles cache misses does not check if the address from which it fetched lies within the cache before blindly writing to it. As such it is possible for the guest to...

PT-2017-10095

Name of the Vulnerable Software and Affected Versions Xen versions 4.5.x through 4.7.x Description The issue allows local HVM guest OS users to cause a denial of service, resulting in a guest crash, by leveraging IDT entry miscalculation when emulating instructions that generate software interrup...

PT-2017-10103

Name of the Vulnerable Software and Affected Versions Xen affected versions not specified Description The issue is related to the x86 emulator in Xen, which does not properly handle x86 NULL segments when accessing memory. This could potentially allow local HVM guest users to gain privileges...