xen: hypervisor memory corruption due to x86 emulator flaw (xsa123)

It was found that the Xen hypervisor x86 CPU emulator implementation did not correctly handle certain instructions with segment overrides, potentially resulting in a memory corruption. A malicious guest user could use this flaw to read arbitrary data relating to other guests, cause a denial of...

Important: Red Hat Security Advisory: kernel security update

Updated kernel packages that fix two security issues and two bugs are now available for Red Hat Enterprise Linux 5. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, are...

RHEL 6 : rhev-hypervisor (RHSA-2016:0379) (DROWN)

An updated rhev-hypervisor package that fixes several security issues, bugs, and enhancements is now available. Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

[SECURITY] Fedora 22 Update: xen-4.5.2-8.fc22

This package contains the XenD daemon and xm command line tools, needed to manage virtual machines running under the Xen hypervisor...

[SECURITY] Fedora 23 Update: xen-4.5.2-8.fc23

This package contains the XenD daemon and xm command line tools, needed to manage virtual machines running under the Xen hypervisor...

How to trigger a memory dump from a Windows virtual machine

This article describes how to trigger and capture a memory dump from a Windows Virtual Machine VM running on a XenServer 8 or Citrix Hypervisor 8.2 CU1 host. Refer to the Microsoft KB article, Generate a kernel or complete crash dump for more information. Troubleshooting unresponsive Windows VMs...

Critical: Red Hat Security Advisory: rhev-hypervisor security update

Updated rhev-hypervisor packages that fix one security issue are now available. Red Hat Product Security has rated this update as having Critical security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available from the CVE link in the...

DEBIAN-CVE-2016-2271

VMX in Xen 4.6.x and earlier, when using an Intel or Cyrix CPU, allows local HVM guest users to cause a denial of service guest crash via vectors related to a non-canonical RIP...

UBUNTU-CVE-2016-2271

VMX in Xen 4.6.x and earlier, when using an Intel or Cyrix CPU, allows local HVM guest users to cause a denial of service guest crash via vectors related to a non-canonical RIP...

PT-2016-1285

Name of the Vulnerable Software and Affected Versions Xen versions 4.6.x and earlier Description The issue exists due to insufficient input validation in the Xen hypervisor. Exploitation of this issue may allow a local attacker to cause a denial of service, resulting in a host reboot, by affectin...

Xen Project Explains Patch SNAFU

Xen Project dropped the ball on two important security patches when it released a maintenance update for its popular hypervisor software on Tuesday. On its company blog today, Xen acknowledged what it called an “oversight” and attempted to explain what went wrong. Effected is maintenance release...

x86: inconsistent cachability flags on guest mappings

ISSUE DESCRIPTION Multiple mappings of the same physical page with different cachability setting can cause problems. While one category risk of using stale data affects only guests themselves and hence avoiding this can be left for them to control, the other category being Machine Check exception...

[SECURITY] Fedora 22 Update: xen-4.5.2-7.fc22

This package contains the XenD daemon and xm command line tools, needed to manage virtual machines running under the Xen hypervisor...

[SECURITY] Fedora 23 Update: xen-4.5.2-7.fc23

This package contains the XenD daemon and xm command line tools, needed to manage virtual machines running under the Xen hypervisor...

Apple Mac OSX Kernel - Hypervisor Driver Use-After-Free

/ Source: https://code.google.com/p/google-security-research/issues/detail?id=580 The hvspace lock group gets an extra ref dropped when you kill a process with an AppleHV userclient; one via IOService::terminateWorker calling the AppleHVClient::free method which calls lckrwfree on the lock group...

Apple Mac OSX Kernel - Hypervisor Driver Use-After-Free

Apple Mac OSX Kernel - Hypervisor Driver Use-After-Free / Source: https://code.google.com/p/google-security-research/issues/detail?id=580 The hvspace lock group gets an extra ref dropped when you kill a process with an AppleHV userclient; one via IOService::terminateWorker calling the...

Xen 'PV superpage' function security bypass vulnerability

Xen is an open source virtual machine monitor product developed at the University of Cambridge, UK. The product enables different and incompatible operating systems to run on the same computer and supports runtime migration to ensure uptime and avoid downtime. A security vulnerability exists in t...

Apple Mac OSX - Kernel Hypervisor Driver Use-After-Free

Exploit for macOS platform in category dos / poc / Source: https://code.google.com/p/google-security-research/issues/detail?id=580 The hvspace lock group gets an extra ref dropped when you kill a process with an AppleHV userclient; one via IOService::terminateWorker calling the AppleHVClient::fre...

CVE-2016-1571

The paginginvlpg function in include/asm-x86/paging.h in Xen 3.3.x through 4.6.x, when using shadow mode paging or nested virtualization is enabled, allows local HVM guest users to cause a denial of service host crash via a non-canonical guest address in an INVVPID instruction, which triggers a...

CVE-2016-1571

The paginginvlpg function in include/asm-x86/paging.h in Xen 3.3.x through 4.6.x, when using shadow mode paging or nested virtualization is enabled, allows local HVM guest users to cause a denial of service host crash via a non-canonical guest address in an INVVPID instruction, which triggers a...