CVE-2013-6457

The libxlDomainGetNumaParameters function in the libxl driver libxl/libxldriver.c in libvirt before 1.2.1 does not properly initialize the nodemap, which allows local users to cause a denial of service invalid free operation and crash or possibly execute arbitrary code via an inactive domain to t...

DEBIAN-CVE-2013-4371

Use-after-free vulnerability in the libxllistcpupool function in the libxl toolstack library in Xen 4.2.x and 4.3.x, when running "under memory pressure," returns the original pointer when the realloc function fails, which allows local users to cause a denial of service heap corruption and crash...

use-after-free in libxl_list_cpupool under memory pressure

ISSUE DESCRIPTION If realloc3 fails then libxllistcpupool will incorrectly return the now-free original pointer. IMPACT An attacker may be able to cause a multithreaded toolstack using this function to race against itself leading to heap corruption and a potential DoS. Depending on the malloc...

qemu disk backend (qdisk) resource leak

ISSUE DESCRIPTION The qdisk PV disk backend in the qemu-xen flavour of qemu "upstream qemu" can be influenced by a malicious frontend to leak mapped grant references. IMPACT A malicious HVM guest can cause the backend domain to run out of grant references, leading to a DoS for any other domain...

Fedora 19 : xen-4.2.3-1.fc19 (2013-16357)

update to xen-4.2.3 includes fix for 'libxl partially sets up HVM passthrough even with disabled iommu' XSA-61, CVE-2013-4329 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean a...

CVE-2013-4329

The xenlight library libxl in Xen 4.0.x through 4.2.x, when IOMMU is disabled, provides access to a busmastering-capable PCI passthrough device before the IOMMU setup is complete, which allows local HVM guest domains to gain privileges or cause a denial of service via a DMA instruction...

DEBIAN-CVE-2013-4329

The xenlight library libxl in Xen 4.0.x through 4.2.x, when IOMMU is disabled, provides access to a busmastering-capable PCI passthrough device before the IOMMU setup is complete, which allows local HVM guest domains to gain privileges or cause a denial of service via a DMA instruction...

Information disclosure

The xenlight library libxl in Xen 4.0.x through 4.2.x, when IOMMU is disabled, provides access to a busmastering-capable PCI passthrough device before the IOMMU setup is complete, which allows local HVM guest domains to gain privileges or cause a denial of service via a DMA instruction...

CVE-2013-4329

The xenlight library libxl in Xen 4.0.x through 4.2.x, when IOMMU is disabled, provides access to a busmastering-capable PCI passthrough device before the IOMMU setup is complete, which allows local HVM guest domains to gain privileges or cause a denial of service via a DMA instruction...

CVE-2013-4329

The xenlight library libxl in Xen 4.0.x through 4.2.x, when IOMMU is disabled, provides access to a busmastering-capable PCI passthrough device before the IOMMU setup is complete, which allows local HVM guest domains to gain privileges or cause a denial of service via a DMA instruction...

libxl partially sets up HVM passthrough even with disabled iommu

ISSUE DESCRIPTION With HVM domains, libxl's setup of PCI passthrough devices does the IOMMU setup after giving via the device model the guest access to the hardware and advertising it to the guest. If the IOMMU is disabled the overall setup fails, but after the device has been made available to t...

Design/Logic Flaw

The libxenlight libxl toolstack library in Xen 4.0.x, 4.1.x, and 4.2.x uses weak permissions for xenstore keys for paravirtualised and emulated serial console devices, which allows local guest administrators to modify the xenstore value via unspecified vectors...

CVE-2013-2211

CVE-2013-2211 concerns the Xen hypervisor, where the libxenlight (libxl) toolstack library in Xen 4.0.x, 4.1.x, and 4.2.x uses weak permissions on xenstore keys for paravirtualised and emulated serial console devices. This allows a local guest administrator to modify the xenstore value via unspec...

SuSE 11.3 Security Update : Xen (SAT Patch Number 8063)

The Xen hypervisor and toolset has been updated to 4.2.206 to fix various bugs and security issues : The following security issues have been addressed : - Various integer overflows in the ELF loader were fixed. XSA-55. CVE-2013-2194 - Various pointer dereferences issues in the ELF loader were...

Fedora 19 : xen-4.2.2-10.fc19 (2013-11837)

XSA-45/CVE-2013-1918 breaks page reference counting let pygrub handle set default='$nextentry' line in F19 libxl: Set vfb and vkb devid if not done so by the caller add upstream patch for PCI passthrough problems after XSA-46 xenstore permissions not set correctly by libxl XSA-57 Note that Tenabl...

Fedora 18 : xen-4.2.2-10.fc18 (2013-11874)

XSA-45/CVE-2013-1918 breaks page reference counting let pygrub handle set default='$nextentry' line in F19 libxl: Set vfb and vkb devid if not done so by the caller Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable...

libxl allows guest write access to sensitive console related xenstore keys

ISSUE DESCRIPTION The libxenlight libxl toolstack library does not correctly set permissions on xenstore keys relating to paravirtualised and emulated serial console devices. This could allow a malicious guest administrator to change values in xenstore which the host later relies on being...

Fedora 18 : libvirt-0.10.2.3-1.fc18 (2013-1644)

Rebased to version 0.10.2.3 - Fix libxl driver to build against xen 4.2 bz 870689 - Fix possible crash when destroying guests bz 877110 - Fix loading sysctl file bz 887017 - Fix svirt memory leak bz 890039 - Fix attaching PCI netdev to VM bz 893131 - Fix libvirtd segfault on shutdown bz 903184 -...