CVE-2017-15593

An issue was discovered in Xen through 4.9.x allowing x86 PV guest OS users to cause a denial of service memory leak because reference counts are mishandled...

CVE-2017-15594

An issue was discovered in Xen through 4.9.x allowing x86 SVM PV guest OS users to cause a denial of service hypervisor crash or gain privileges because IDT settings are mishandled during CPU hotplugging...

CVE-2017-15594

An issue was discovered in Xen through 4.9.x allowing x86 SVM PV guest OS users to cause a denial of service hypervisor crash or gain privileges because IDT settings are mishandled during CPU hotplugging...

Race condition

An issue was discovered in Xen through 4.9.x allowing x86 PV guest OS users to execute arbitrary code on the host OS because of a race condition that can cause a stale TLB entry...

CVE-2017-15588

An issue was discovered in Xen through 4.9.x allowing x86 PV guest OS users to execute arbitrary code on the host OS because of a race condition that can cause a stale TLB entry...

CVE-2017-15588

An issue was discovered in Xen through 4.9.x allowing x86 PV guest OS users to execute arbitrary code on the host OS because of a race condition that can cause a stale TLB entry...

CVE-2017-15594

An issue was discovered in Xen through 4.9.x allowing x86 SVM PV guest OS users to cause a denial of service hypervisor crash or gain privileges because IDT settings are mishandled during CPU hotplugging...

CVE-2017-15595

An issue was discovered in Xen through 4.9.x allowing x86 PV guest OS users to cause a denial of service unbounded recursion, stack consumption, and hypervisor crash or possibly gain privileges via crafted page-table stacking...

CVE-2017-15594

CVE-2017-15594 affects the Xen hypervisor up to version 4.9.x. The root cause is mishandling of IDT settings during CPU hotplugging, allowing x86 SVM PV guest OS users to cause a hypervisor crash (DoS) or escalate privileges. Exploitation details and concrete fixes are not provided in the supplie...

CVE-2017-15588

An issue was discovered in Xen through 4.9.x allowing x86 PV guest OS users to execute arbitrary code on the host OS because of a race condition that can cause a stale TLB entry...

CVE-2017-15593

An issue was discovered in Xen through 4.9.x allowing x86 PV guest OS users to cause a denial of service memory leak because reference counts are mishandled...

CVE-2017-15594

An issue was discovered in Xen through 4.9.x allowing x86 SVM PV guest OS users to cause a denial of service hypervisor crash or gain privileges because IDT settings are mishandled during CPU hotplugging...

CVE-2017-15588

CVE-2017-15588 affects the Xen hypervisor. Documented as a race-condition in Xen up to 4.9.x that can cause a stale TLB entry, enabling local x86 PV guest users to execute arbitrary code on the host. Public details describe a host-wards impact via TLB/ paging-structure cache timing, with the vuln...

Xen - Pagetable De-typing Unbounded Recursion

Xen - Pagetable De-typing Unbounded Recursion Xen allows pagetables of the same level to map each other as readonly in PV domains. This is useful if a guest wants to use the self-referential pagetable trick for easy access to pagetables by mapped virtual address. When cleaning up a pagetable afte...

Xen - Unbounded Recursion in Pagetable De-typing Vulnerability

Exploit for linux platform in category dos / poc Xen allows pagetables of the same level to map each other as readonly in PV domains. This is useful if a guest wants to use the self-referential pagetable trick for easy access to pagetables by mapped virtual address. When cleaning up a pagetable...

Xen - Pagetable De-typing Unbounded Recursion

Xen allows pagetables of the same level to map each other as readonly in PV domains. This is useful if a guest wants to use the self-referential pagetable trick for easy access to pagetables by mapped virtual address. When cleaning up a pagetable after the last typed reference to it has been...

x86: Incorrect handling of IST settings during CPU hotplug

ISSUE DESCRIPTION The x86-64 architecture allows interrupts to be run on distinct stacks. The choice of stack is encoded in a field of the corresponding interrupt descriptor in the Interrupt Descriptor Table IDT. That field selects an entry from the active Task State Segment TSS. Since, on AMD...

x86: Incorrect handling of self-linear shadow mappings with translated guests

ISSUE DESCRIPTION The shadow pagetable code uses linear mappings to inspect and modify the shadow pagetables. A linear mapping which points back to itself is known as self-linear. For translated guests, the shadow linear mappings being in a separate address space are not intended to be self-linea...

page type reference leak on x86

ISSUE DESCRIPTION The page type system of Xen requires cleanup when the last reference for a given page is being dropped. In order to exclude simultaneous updates to a given page by multiple parties, pages which are updated are locked beforehand. This locking includes temporarily increasing the...

Unlimited recursion in linear pagetable de-typing

ISSUE DESCRIPTION x86 PV guests are permitted to set up certain forms of what is often called "linear page tables", where pagetables contain references to other pagetables at the same level or higher. Certain restrictions apply in order to fit into Xen's page type handling system. An important...