Xen PV DoS vulnerability with SYSENTER

ISSUE DESCRIPTION The SYSENTER instruction can be used by PV guests to accelerate system call processing. This instruction, however, leaves the EFLAGS register mostly unmodified - in particular, the NT flag doesn't get cleared. If the hypervisor subsequently uses IRET to return to the guest which...

Debian Security Advisory DSA 2662-1 (xen - several vulnerabilities)

Multiple vulnerabilities have been discovered in the Xen hypervisor. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2013-1917 The SYSENTER instruction can be used by PV guests to accelerate system call processing. This instruction, however, leaves the EFLA...

Debian DSA-2501-1 : xen - several vulnerabilities

Several vulnerabilities were discovered in Xen, a hypervisor. - CVE-2012-0217 Xen does not properly handle uncanonical return addresses on Intel amd64 CPUs, allowing amd64 PV guests to elevate to hypervisor privileges. AMD processors, HVM and i386 guests are not affected. - CVE-2012-0218 Xen does...

Fedora 15 : xen-4.1.2-8.fc15 (2012-9430)

make pygrub cope better with big files from guest 818412 CVE-2012-2625, 64-bit PV guest privilege escalation vulnerability CVE-2012-0217, guest denial of service on syscall/sysenter exception generation CVE-2012-0218, PV guest host Denial of Service CVE-2012-2934 Note that Tenable Network Securit...

Microsoft Windows Vista2008 - NtUserCheckAccessForIntegrityLevel Use-After-Free

Microsoft Windows Vista2008 - NtUserCheckAccessForIntegrityLevel Use-After-Free Windows Vista/Server 2008 NtUserCheckAccessForIntegrityLevel Use-after-free Vulnerability Intro: Due to hostility toward security researchers, the most recent example being of Tavis Ormandy, a number of us from the...

Microsoft Windows Vista/2008 - NtUserCheckAccessForIntegrityLevel Use-After-Free

Windows Vista/Server 2008 NtUserCheckAccessForIntegrityLevel Use-after-free Vulnerability Intro: Due to hostility toward security researchers, the most recent example being of Tavis Ormandy, a number of us from the industry and some not from the industry have come together to form MSRC: the...

CVE-2009-2715

Sun VirtualBox 2.2 through 3.0.2 r49928 allows guest OS users to cause a denial of service Linux host OS reboot via a sysenter instruction...

CVE-2009-2715

Sun VirtualBox 2.2 through 3.0.2 r49928 allows guest OS users to cause a denial of service Linux host OS reboot via a sysenter instruction...

Design/Logic Flaw

Sun VirtualBox 2.2 through 3.0.2 r49928 allows guest OS users to cause a denial of service Linux host OS reboot via a sysenter instruction...

CVE-2009-2715

Sun VirtualBox 2.2 through 3.0.2 r49928 allows guest OS users to cause a denial of service Linux host OS reboot via a sysenter instruction...

Sun VirtualBox Host Reboot

Sun's VirtualBox host reboot PoC by Tadas Vilkeliskis Disclosure made at 2009-08-01 VULNERABILITY INFORMATION Remotely exploitable: no Locally exploitable: yes Affected versions: 2.2 - 3.0.2 r49928 for Linux VULNERABILITY DESCRIPTION VirtualBox VM is unable to handle fast call to privilege level ...

Sun xVM VirtualBox 2.2 < 3.0.2 r49928 - Local Host Reboot (Denial of Service) (PoC)

Sun's VirtualBox host reboot PoC by Tadas Vilkeliskis Disclosure made at 2009-08-01 VULNERABILITY INFORMATION Remotely exploitable: no Locally exploitable: yes Affected versions: 2.2 - 3.0.2 r49928 for Linux VULNERABILITY DESCRIPTION VirtualBox VM is unable to handle fast call to privilege level ...

VirtualBox 2.2 - 3.0.2 r49928 Local Host Reboot PoC

No description provided by source. Sun's VirtualBox host reboot PoC by Tadas Vilkeliskis [email protected] Disclosure made at 2009-08-01 VULNERABILITY INFORMATION Remotely exploitable: no Locally exploitable: yes Affected versions: 2.2 - 3.0.2 r49928 for Linux VULNERABILITY DESCRIPTION...

kernel: local denial of service due to NT bit leakage

Linux kernel before 2.6.18, when running on x8664 systems, does not properly save or restore EFLAGS during a context switch, which allows local users to cause a denial of service crash by causing SYSENTER to set an NT flag, which can trigger a crash on the IRET of the next task...

PT-2006-1007 · Debian +2 · Debian +2

Name of the Vulnerable Software and Affected Versions: Debian GNU/Linux kernel-patch-openvz affected versions not specified Linux kernel versions prior to 2.6.18 Description: The issue affects the Linux kernel and may lead to disruption of confidentiality, integrity, and availability of protected...

linux/x86 /bin/sh sysenter Opcode Array Payload 23 Bytes

linux/x86 /bin/sh sysenter Opcode Array Payload 23 Bytes. Shellcode exploit for linx86 platform / lnxbinsh4.c - v1 - 23 Byte /bin/sh sysenter Opcode Array Payload Copyrightc 2005 c0ntex Copyrightc 2005 BaCkSpAcE This program is free software; you can redistribute it and/or modify it under the ter...

linux/x86 /bin/sh sysenter Opcode Array Payload 23 Bytes

No description provided by source. / lnxbinsh4.c - v1 - 23 Byte /bin/sh sysenter Opcode Array Payload Copyrightc 2005 c0ntex [email protected] Copyrightc 2005 BaCkSpAcE [email protected] This program is free software; you can redistribute it and/or modify it under the terms of the GNU...

linux/x86 /bin/sh sysenter Opcode Array Payload 23 Bytes

Exploit for linux/x86 platform in category shellcode ======================================================== linux/x86 /bin/sh sysenter Opcode Array Payload 23 Bytes ======================================================== / lnxbinsh4.c - v1 - 23 Byte /bin/sh sysenter Opcode Array Payload...

linux/x86 /bin/sh sysenter Opcode Array Payload 27 Bytes

linux/x86 /bin/sh sysenter Opcode Array Payload 27 Bytes. Shellcode exploit for linx86 platform / lnxbinsh3.c - v1 - 27 Byte /bin/sh sysenter Opcode Array Payload Copyrightc 2005 c0ntex Copyrightc 2005 amnesia This program is free software; you can redistribute it and/or modify it under the terms...

linux/x86 /bin/sh sysenter Opcode Array Payload 27 Bytes

Exploit for linux/x86 platform in category shellcode ======================================================== linux/x86 /bin/sh sysenter Opcode Array Payload 27 Bytes ======================================================== / lnxbinsh3.c - v1 - 27 Byte /bin/sh sysenter Opcode Array Payload...