Design/Logic Flaw

The getpagefroml3e function in arch/x86/mm.c in Xen allows local 32-bit PV guest OS administrators to gain host OS privileges via vectors related to L3 recursive pagetables...

CVE-2016-7092

CVE-2016-7092 affects Xen: the get_page_from_l3e function in arch/x86/mm.c allows a local 32-bit PV guest administrator to gain host OS privileges via vectors related to L3 recursive pagetables. Connected advisories reference upstream XSA-185 and related fixes, indicating this is a privilege-esca...

CVE-2016-7092

The getpagefroml3e function in arch/x86/mm.c in Xen allows local 32-bit PV guest OS administrators to gain host OS privileges via vectors related to L3 recursive pagetables...

Fedora 24 : xen (2016-7d2c67d1f5)

x86: Disallow L3 recursive pagetable for 32-bit PV guests XSA-185, CVE-2016-7092 1374470 x86: Mishandling of instruction pointer truncation during emulation XSA-186, CVE-2016-7093 1374471 x86 HVM: Overflow of shctxt-segreg XSA-187, CVE-2016-7094 1374473 Note that Tenable Network Security has...

Xen release 4 an important vulnerability advisories-vulnerability warning-the black bar safety net

! Today the Xen Update 4 important patch announcement XSA-1 8 5, AND XSA-1 8 6, AND XSA-1 8 7, AND XSA-1 8 8, wherein the XSA-1 8 5, AND XSA-1 8 6, AND XSA-1 8 8 can be caused to include PV, HVM mode in Xen host is penetrated, the recommended use of the Xen Platform Update Now patch. XSA-1 8 5CVE...

x86: Disallow L3 recursive pagetable for 32-bit PV guests

ISSUE DESCRIPTION On real hardware, a 32-bit PAE guest must leave the USER and RW bit clear in L3 pagetable entries, but the pagetable walk behaves as if they were set. The L3 entries are cached in processor registers, and don't actually form part of the pagewalk. When running a 32-bit PV guest o...

x86: Mishandling of instruction pointer truncation during emulation

ISSUE DESCRIPTION When emulating HVM instructions, Xen uses a small i-cache for fetches from guest memory. The code that handles cache misses does not check if the address from which it fetched lies within the cache before blindly writing to it. As such it is possible for the guest to overwrite...

xen-kernel -- x86: Disallow L3 recursive pagetable for 32-bit PV guests

The Xen Project reports: On real hardware, a 32-bit PAE guest must leave the USER and RW bit clear in L3 pagetable entries, but the pagetable walk behaves as if they were set. The L3 entries are cached in processor registers, and don't actually form part of the pagewalk. When running a 32-bit PV...

SUSE SLED12 / SLES12 Security Update : qemu (SUSE-SU-2016:1703-1)

qemu was updated to fix 29 security issues. These security issues were fixed : - CVE-2016-4439: Avoid OOB access in 53C9X emulation bsc980711 - CVE-2016-4441: Avoid OOB access in 53C9X emulation bsc980723 - CVE-2016-4952: Avoid OOB access in Vmware PV SCSI emulation bsc981266 - CVE-2015-8817: Avo...

Fedora 23 : xen (2016-0049aa6e5d) (Bunker Buster)

x86: Privilege escalation in PV guests XSA-182, CVE-2016-6258 x86: Missing SMAP whitelisting in 32-bit exception / event delivery XSA-183, CVE-2016-6259 virtio: unbounded memory allocation issue XSA-184, CVE-2016-5403 Qemu: scsi: esp: OOB write access in espdodma CVE-2016-6351 Note that Tenable...

Citrix XenServer Multiple Vulnerabilities (CTX214954) (Bunker Buster)

The version of Citrix XenServer running on the remote host is missing a security hotfix. It is, therefore, affected by multiple vulnerabilities : - A privilege escalation vulnerability known as 'Bunker Buster' exists in the paravirtualization PV pagetable implementation due to incorrect usage of...

Xen Privilege Escalation (XSA-182) (Bunker Buster)

According to its self-reported version number, the remote Xen hypervisor is affected by a privilege escalation vulnerability in the paravirtualization PV pagetable implementation due to incorrect usage of fast-paths for making updates to pre-existing pagetable entries. An attacker with...

CVE-2016-6258

The PV pagetable code in arch/x86/mm.c in Xen 4.7.x and earlier allows local 32-bit PV guest OS administrators to gain host OS privileges by leveraging fast-paths for updating pagetable entries...

CVE-2016-6258

The PV pagetable code in arch/x86/mm.c in Xen 4.7.x and earlier allows local 32-bit PV guest OS administrators to gain host OS privileges by leveraging fast-paths for updating pagetable entries...

Code injection

The PV pagetable code in arch/x86/mm.c in Xen 4.7.x and earlier allows local 32-bit PV guest OS administrators to gain host OS privileges by leveraging fast-paths for updating pagetable entries...

Design/Logic Flaw

Xen 4.5.x through 4.7.x do not implement Supervisor Mode Access Prevention SMAP whitelisting in 32-bit exception and event delivery, which allows local 32-bit PV guest OS kernels to cause a denial of service hypervisor and VM crash by triggering a safety check...

CVE-2016-6258

The PV pagetable code in arch/x86/mm.c in Xen 4.7.x and earlier allows local 32-bit PV guest OS administrators to gain host OS privileges by leveraging fast-paths for updating pagetable entries...

CVE-2016-6258

The PV pagetable code in arch/x86/mm.c in Xen 4.7.x and earlier allows local 32-bit PV guest OS administrators to gain host OS privileges by leveraging fast-paths for updating pagetable entries...

FreeBSD : xen-kernel -- x86: Privilege escalation in PV guests (032aa524-5854-11e6-b334-002590263bf5) (Bunker Buster)

The Xen Project reports : The PV pagetable code has fast-paths for making updates to pre-existing pagetable entries, to skip expensive re-validation in safe cases e.g. clearing only Access/Dirty bits. The bits considered safe were too broad, and not actually safe. A malicious PV guest administrat...

The XEN virtual machine monitor appears“deadly”vulnerabilities-vulnerability warning-the black bar safety net

! XEN has always been known for high performance, less resource-intensive, win IBM, AMD, HP, Red Hat and Novell, and many other world-class hardware and software manufacturers of high recognition and strong support of many domestic and foreign enterprises and users to use XEN to build a...