Security feature bypass

The 1 ioportread and 2 ioportwrite functions in Xen, when qemu is used as a device model within Xen, might allow local x86 HVM guest OS administrators to gain qemu process privileges via vectors involving an out-of-range ioport access...

CVE-2016-9637

CVE-2016-9637 affects Xen when qemu is used as a device model; the ioport_read/ioport_write paths can mishandle a 32-bit ioport address, enabling a local x86 HVM guest administrator to escalate privileges to the qemu process due to out-of-range ioport access. The issue is tied to out-of-bounds ar...

OracleVM 3.3 : xen (OVMSA-2016-0171)

The remote OracleVM system is missing necessary patches to address critical security updates : - qemuup: ioportread, ioportwrite: be defensive about 32-bit addresses On x86, ioport addresses are 16-bit. That these functions take 32-bit arguments is a mistake. Changing the argument type to 16-bit...