CVE-2012-5525

The getpagefromgfn hypercall function in Xen 4.2 allows local PV guest OS administrators to cause a denial of service crash via a crafted GFN that triggers a buffer over-read...

CVE-2012-5525

The getpagefromgfn hypercall function in Xen 4.2 allows local PV guest OS administrators to cause a denial of service crash via a crafted GFN that triggers a buffer over-read...

Debian DSA-2582-1 : xen - several vulnerabilities

Multiple denial of service vulnerabilities have been discovered in the Xen Hypervisor. One of the issue CVE-2012-5513 could even lead to privilege escalation from guest to host. Some of the recently published Xen Security Advisories XSA 25and 28 are not fixed by this update and should be fixed in...

SuSE 10 Security Update : Xen (ZYPP Patch Number 8379)

This update fixes the following security issues in xen : - XENMEMexchange may overwrite hypervisor memory XSA-29. CVE-2012-5513 - Several memory hypercall operations allow invalid extent order values XSA-31. CVE-2012-5515 Also the following bugs have been fixed and upstream patches have been...

Several memory hypercall operations allow invalid extent order values

ISSUE DESCRIPTION Allowing arbitrary extentorder input values for XENMEMdecreasereservation, XENMEMpopulatephysmap, and XENMEMexchange can cause arbitrarily long time being spent in loops without allowing vital other code to get a chance to execute. This may also cause inconsistent state resultin...

XEN: security and bugfix update (important)

This security update of XEN fixes various bugs and security issues. - Upstream patch 26088-xend-xml-filesize-check.patch - bnc787163 - CVE-2012-4544: xen: Domain builder Out-of- memory due to malicious kernel/ramdisk XSA 25 CVE-2012-4544-xsa25.patch - bnc779212 - CVE-2012-4411: XEN / qemu: guest...

CVE-2012-4538

The HVMOPpagetabledying hypercall in Xen 4.0, 4.1, and 4.2 does not properly check the pagetable state when running on shadow pagetables, which allows a local HVM guest OS to cause a denial of service hypervisor crash via unspecified vectors...

CVE-2012-4538

Technical details about CVE-2012-4538 are not publicly provided in the connected documents. Please monitor for updates in the referenced advisories and vendor notices.

CVE-2012-4538

The HVMOPpagetabledying hypercall in Xen 4.0, 4.1, and 4.2 does not properly check the pagetable state when running on shadow pagetables, which allows a local HVM guest OS to cause a denial of service hypervisor crash via unspecified vectors...

CVE-2012-3494

The setdebugreg hypercall in include/asm-x86/debugreg.h in Xen 4.0, 4.1, and 4.2, and Citrix XenServer 6.0.2 and earlier, when running on x86-64 systems, allows local OS guest users to cause a denial of service host crash by writing to the reserved bits of the DR7 debug control register...

DEBIAN-CVE-2012-3494

The setdebugreg hypercall in include/asm-x86/debugreg.h in Xen 4.0, 4.1, and 4.2, and Citrix XenServer 6.0.2 and earlier, when running on x86-64 systems, allows local OS guest users to cause a denial of service host crash by writing to the reserved bits of the DR7 debug control register...

CVE-2012-3494

The setdebugreg hypercall in include/asm-x86/debugreg.h in Xen 4.0, 4.1, and 4.2, and Citrix XenServer 6.0.2 and earlier, when running on x86-64 systems, allows local OS guest users to cause a denial of service host crash by writing to the reserved bits of the DR7 debug control register...

CVE-2012-3495

CVE-2012-3495 affects the Xen hypervisor: the physdev_get_free_pirq hypercall does not validate the return value of get_free_pirq, and if that call fails it uses the error code as an array index. This can cause an invalid memory write leading to host crash and, per the description, potential priv...

CVE-2012-3495

The physdevgetfreepirq hypercall in arch/x86/physdev.c in Xen 4.1.x and Citrix XenServer 6.0.2 and earlier uses the return value of the getfreepirq function as an array index without checking that the return value indicates an error, which allows guest OS users to cause a denial of service invali...

SUSE-SU-2015:0940-1 Security update for Xen

This update fixes the following security issues in Xen: CVE-2012-5510: Grant table version switch list corruption vulnerability XSA-26 CVE-2012-5511: Several HVM operations do not validate the range of their inputs XSA-27 CVE-2012-5513: XENMEMexchange may overwrite hypervisor memory XSA-29...

CVE-2012-4539

Xen 4.0 through 4.2, when running 32-bit x86 PV guests on 64-bit hypervisors, allows local guest OS administrators to cause a denial of service infinite loop and hang or crash via invalid arguments to GNTTABOPgetstatusframes, aka "Grant table hypercall infinite loop DoS vulnerability."...

Unhooking empty PAE entries DoS vulnerability

ISSUE DESCRIPTION The HVMOPpagetabledying hypercall does not correctly check the caller's pagetable state, leading to a hypervisor crash. IMPACT An HVM guest running on shadow pagetables that is, not HAP can cause the hypervisor to crash. VULNERABLE SYSTEMS All Xen versions from 4.0 onwards are...

SuSE 10 Security Update : Xen (ZYPP Patch Number 8268)

XEN was updated to fix multiple bugs and security issues. The following security issues have been fixed : - xen: hypercall setdebugreg vulnerability XSA-12. CVE-2012-3494 - xen: Qemu VT100 emulation vulnerability XSA-17. CVE-2012-3515 - xen: pv bootloader doesn't check the size of the bzip2 or lz...

multiple TMEM hypercall vulnerabilities

ISSUE DESCRIPTION Several sub-operations of the Transcendent Memory TMEM hypercall either do not correctly validate their inputs, do not correctly validate the privilege of the calling guest, or have other security-relevant bugs. A full list of the vulnerabilities in the TMEM system is not...

hypercall physdev_get_free_pirq vulnerability

ISSUE DESCRIPTION PHYSDEVOPgetfreepirq does not check that its call to getfreepirq succeeded, and if it fails will use the error code as an array index. IMPACT A malicious guest might be able to cause the host to crash, leading to a DoS, depending on the exact memory layout. Privilege escalation ...