CVE-2012-3433

Xen 4.0 and 4.1 allows local HVM guest OS kernels to cause a denial of service domain 0 VCPU hang and kernel panic by modifying the physical address space in a way that triggers excessive shared page search time during the p2m teardown...

CVE-2012-3433

Xen 4.0 and 4.1 allows local HVM guest OS kernels to cause a denial of service domain 0 VCPU hang and kernel panic by modifying the physical address space in a way that triggers excessive shared page search time during the p2m teardown...

CVE-2012-4538

The HVMOPpagetabledying hypercall in Xen 4.0, 4.1, and 4.2 does not properly check the pagetable state when running on shadow pagetables, which allows a local HVM guest OS to cause a denial of service hypervisor crash via unspecified vectors...

DEBIAN-CVE-2012-3498

PHYSDEVOPmappirq in Xen 4.1 and 4.2 and Citrix XenServer 6.0.2 and earlier allows local HVM guest OS kernels to cause a denial of service host crash and possibly read hypervisor or guest memory via vectors related to a missing range check of map-index...

Fedora 17 : xen-4.1.3-6.fc17 (2012-18242)

A guest can block a cpu by setting a bad VCPU deadline XSA 20, CVE-2012-4535 876198 HVM guest can use invalid pirq values to crash xen XSA 21, CVE-2012-4536 876200 HVM guest can exhaust p2m table crashing xen XSA 22, CVE-2012-4537 876203 PAE HVM guest can crash hypervisor XSA-23, CVE-2012-4538...

Fedora 16 : xen-4.1.3-4.fc16 (2012-18249)

A guest can block a cpu by setting a bad VCPU deadline XSA 20, CVE-2012-4535 876198 HVM guest can use invalid pirq values to crash xen XSA 21, CVE-2012-4536 876200 HVM guest can exhaust p2m table crashing xen XSA 22, CVE-2012-4537 876203 PAE HVM guest can crash hypervisor XSA-23, CVE-2012-4538...

CVE-2012-4537

Xen 3.4 through 4.2, and possibly earlier versions, does not properly synchronize the p2m and m2p tables when the setp2mentry function fails, which allows local HVM guest OS administrators to cause a denial of service memory consumption and assertion failure, aka "Memory mapping failure DoS...

pirq range check DoS vulnerability

ISSUE DESCRIPTION domainpirqtoemuirq uses the guest provided pirq value before range checking it, and physdevunmappirq uses domainpirqtoemuirq without checking the pirq value either. Invalid pirq values can cause Xen to read out of array bounds, usually resulting in a fatal page fault. IMPACT A...

Security Update for Xen (important)

Security Update for Xen Following fixes were done: - bnc776995 - attaching scsi control luns with pvscsi - xend/pvscsi: fix passing of SCSI control LUNs xen-bug776995-pvscsi-no-devname.patch - xend/pvscsi: fix usage of persistant device names for SCSI devices...

Debian DSA-2543-1 : xen-qemu-dm-4.0 - multiple vulnerabilities

Multiple vulnerabilities have been discovered in xen-qemu-dm-4.0, the Xen QEMU Device Model virtual machine hardware emulator. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2012-3515 : The device model for HVM domains does not properly handle VT100...

PHYSDEVOP_map_pirq index vulnerability

ISSUE DESCRIPTION PHYSDEVOPmappirq with MAPPIRQTYPEGSI does not range check map-index. IMPACT A malicious HVM guest kernel can crash the host. It might also be able to read hypervisor or guest memory. VULNERABLE SYSTEMS All Xen systems running HVM guests. PV guests are not vulnerable. The...

Fedora 17 : xen-4.1.3-2.fc17 (2012-11755)

fix for 845444 broke xend under systemd, update to 4.1.3, includes fix for untrusted HVM guest can cause the dom0 to hang or crash XSA-11, CVE-2012-3433 843582 remove some unnecessary cache flushing that slow things down, change python options on xend to reduce selinux problems 845444 Note that...

Fedora 16 : xen-4.1.3-1.fc16 (2012-11785)

update to 4.1.3 - fixes untrusted HVM guest can cause the dom0 to hang or crash XSA-11, CVE-2012-3433 843582 remove some unnecessary cache flushing that slow things down 841330 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security...

HVM guest destroy p2m teardown host DoS vulnerability

ISSUE DESCRIPTION An HVM guest is able to manipulate its physical address space such that tearing down the guest takes an extended period amount of time searching for shared pages. This causes the domain 0 VCPU which tears down the domain to be blocked in the destroy hypercall. This causes that...

CVE-2012-3433

Xen 4.0 and 4.1 allows local HVM guest OS kernels to cause a denial of service domain 0 VCPU hang and kernel panic by modifying the physical address space in a way that triggers excessive shared page search time during the p2m teardown...

Fedora 16 : xen-4.1.2-9.fc16 (2012-11190)

in rare circumstances an unprivileged user can crash an HVM guest XSA-10 843766 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without...

Fedora 17 : xen-4.1.2-24.fc17 (2012-11182)

in rare circumstances an unprivileged user can crash an HVM guest XSA-10 843766, remove a dependency on PyXML and Require python-lxml instead of PyXML 842843 adjust systemd service files not to report failures when running without a hypervisor or when xendomains.service doesn't find anything to...

Fedora 15 : xen-4.1.2-6.fc15 (2012-1539)

Fix buffer overflow in e1000 emulation for HVM guests CVE-2012-0029, Start building xen's ocaml, fix a crash and turn a backtrace into an ordinary error Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempt...

SuSE 10 Security Update : Xen (ZYPP Patch Number 7547)

This collective June/2011 Update for Xen provides the following fixes : - Xen does not properly check the upper boundary of user-supplied data in the getfreeport function when getting a new event channel port. A local user on the guest operating system can exploit this flaw to cause denial of...

SuSE 10 Security Update : Xen (ZYPP Patch Number 7703)

This update fixes various bugs in XEN : The following security issues have been fixed : - A denial of service Host Crash in the XEN hypervisor. CVE-2011-2901 - A bug was found in the way Xen handles CPUID instruction emulation during VM exits. An unprivileged guest user can potentially use this...