Xen '/xen/arch/arm/mm.c' Denial of Service Vulnerability

Xen is an open source virtual machine monitor product developed at the University of Cambridge, UK. The product enables different and incompatible operating systems to run on the same computer and supports runtime migration to ensure uptime and avoid downtime. A denial of service vulnerability...

CVE-2017-12137

arch/x86/mm.c in Xen allows local PV guest OS users to gain host OS privileges via vectors related to mapgrantref...

CVE-2016-7092

The getpagefroml3e function in arch/x86/mm.c in Xen allows local 32-bit PV guest OS administrators to gain host OS privileges via vectors related to L3 recursive pagetables...

CVE-2016-7092

The getpagefroml3e function in arch/x86/mm.c in Xen allows local 32-bit PV guest OS administrators to gain host OS privileges via vectors related to L3 recursive pagetables...

Code injection

The PV pagetable code in arch/x86/mm.c in Xen 4.7.x and earlier allows local 32-bit PV guest OS administrators to gain host OS privileges by leveraging fast-paths for updating pagetable entries...

CVE-2016-6258

CVE-2016-6258 affects Xen 4.7.x and earlier, where PV pagetable code in arch/x86/mm.c allows local 32-bit PV guest OS administrators to gain host OS privileges by abusing pagetable fast-path updates. The issue is documented across multiple advisories and vendor/SUSE patches (e.g., Xen/XSA-182 upd...

CVE-2015-7835

CVE-2015-7835 affects Xen 3.4 through 4.6.x. The vulnerability lies in the mod_l2_entry function in arch/x86/mm.c, which does not properly validate level 2 page table entries. This can allow local PV guest administrators to gain privileges via a crafted superpage mapping (privilege escalation). N...

Denial of service

The xenmemaddtophysmapone function in arch/arm/mm.c in Xen 4.5.x, 4.4.x, and earlier does not limit the number of printk console messages when reporting a failure to retrieve a reference on a foreign page, which allows remote domains to cause a denial of service by leveraging permissions to map t...

Null pointer dereference

The dommuupdate function in arch/x86/mm.c in Xen 4.x through 4.4.x does not properly restrict updates to only PV page tables, which allows remote PV guests to cause a denial of service NULL pointer dereference by leveraging hardware emulation services for HVM guests using Hardware Assisted Paging...