Xen 64bit PV Guest - pagetable use-after-type-change Breakout

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1231 This is a bug in Xen that permits an attacker with control over the kernel of a 64bit X86 PV guest to write arbitrary entries into a live top-level pagetable. To prevent PV guests from doing things like mapping live pagetables...

Error "cannot connect to the hypervisor at <ADDRESS> object reference not set to an instance of an object" when running the XDSW

When running the XenDesktop Setup Wizard, it can fail with the following error: "cannot connect to the hypervisor at object reference not set to an instance of an object" The string will contain the actual URL of the vCenter Server. This issue can appear when the DataCenter name on the VMWare sid...

PVS XDSW "Cannot connect to the Hypervisor, object reference not set as an Instance"

When running XDSW, customer encountered generic error "Cannot connect to the Hypervisor, object reference not set as an Instance" This error was encountered just at the stage when the expected screen would be template selection...

EulerOS 2.0 SP1 : kernel (EulerOS-SA-2016-1026)

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - It was found that the Linux kernel KVM subsystem's sysenter instruction emulation was not sufficient. An unprivileged guest user could use this...

openSUSE Security Update : xen (openSUSE-2017-492)

This update for xen to version 4.7.2 fixes the following issues : These security issues were fixed : - CVE-2017-7228: Broken check in memoryexchange permited PV guest breakout bsc1030442. - XSA-206: Unprivileged guests issuing writes to xenstore were able to stall progress of the control domain o...

Security update for xen (important)

This update for xen to version 4.7.2 fixes the following issues: These security issues were fixed: - CVE-2017-7228: Broken check in memoryexchange permited PV guest breakout bsc1030442. - XSA-206: Unprivileged guests issuing writes to xenstore were able to stall progress of the control domain or...

Mac OS X Information Disclosure

The vulnerability of the Hypervisor component in the Mac OS X operating system is related to the lack of protection for service data. Exploiting this vulnerability can allow an intruder, acting locally, to obtain confidential information using uncertain vectors...

PT-2017-2733

Name of the Vulnerable Software and Affected Versions Qualcomm products with Android releases from CAF using the Linux kernel affected versions not specified Description The issue is caused by an integer overflow in the hypervisor of Android CAF builds, which can be exploited by a remote attacker...

PT-2017-2732

Name of the Vulnerable Software and Affected Versions Qualcomm products with Android releases from CAF using the Linux kernel affected versions not specified Description The issue arises due to insufficient validation of input data in the Android CAF build, specifically affecting an argument to a...

[SECURITY] Fedora 24 Update: xen-4.6.5-5.fc24

This package contains the XenD daemon and xm command line tools, needed to manage virtual machines running under the Xen hypervisor...

Microsoft Windows Hyper-V Remote Denial of Service Vulnerability (CNVD-2017-05722)

Microsoft Windows is the popular computer operating system. A remote denial of service vulnerability exists in Microsoft Windows Hyper-V, which can be exploited by an attacker to cause the host computer to crash...

Xen Hypervisor xenstored Write Saturation DoS (XSA-206)

According to its self-reported version number, the Xen hypervisor installed on the remote host is affected by a denial of service vulnerability in xenstored during processing of transactions. An attacker on the guest can exploit this vulnerability by issuing repeated writes to xenstore that...

Xen Hypervisor XENMEM_exchange Memory Disclosure (XSA-212)

According to its self-reported version number, the Xen hypervisor installed on the remote host is affected by an out-of-array memory access error in the memoryexchange function in file common/memory.c due to improper checking of XENMEMexchange input. An attacker on a 64-bit PV guest VM who has...

Xen - Broken Check in 'memory_exchange()' Permits PV Guest Breakout

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1184 This bug report describes a vulnerability in memoryexchange that permits PV guest kernels to write to an arbitrary virtual address with hypervisor privileges. The vulnerability was introduced through a broken fix for...

[SECURITY] Fedora 25 Update: xen-4.7.2-5.fc25

This package contains the XenD daemon and xm command line tools, needed to manage virtual machines running under the Xen hypervisor...

Xen: broken check in memory_exchange() permits PV guest breakout（CVE-2017-7228）

Detailed analysis: Pandavirtualization: Exploiting the Xen hypervisor This bug report describes a vulnerability in memoryexchange that permits PV guest kernels to write to an arbitrary virtual address with the hypervisor privileges. The vulnerability was introduced through a broken fix for...

Pandavirtualization: Exploiting the Xen hypervisor

Posted by Jann Horn, Project Zero On 2017-03-14, I reported a bug to Xen's security team that permits an attacker with control over the kernel of a paravirtualized x86-64 Xen guest to break out of the hypervisor and gain full control over the machine's physical memory. The Xen Project publicly...

[SECURITY] Fedora 25 Update: xen-4.7.2-4.fc25

This package contains the XenD daemon and xm command line tools, needed to manage virtual machines running under the Xen hypervisor...

CVE-2017-7228

An issue known as XSA-212 was discovered in Xen, with fixes available for 4.8.x, 4.7.x, 4.6.x, 4.5.x, and 4.4.x. The earlier XSA-29 fix introduced an insufficient check on XENMEMexchange input, allowing the caller to drive hypervisor memory accesses outside of the guest provided input/output arra...

CVE-2017-7228

An issue known as XSA-212 was discovered in Xen, with fixes available for 4.8.x, 4.7.x, 4.6.x, 4.5.x, and 4.4.x. The earlier XSA-29 fix introduced an insufficient check on XENMEMexchange input, allowing the caller to drive hypervisor memory accesses outside of the guest provided input/output arra...