12970 matches found
Citrix-Virtual-Apps-XEN-Exploit
CVE-2024-xxxx Citrix Virtual Apps and Desktops XEN 未认证远程代码执行 更多技术细节请参阅我们的博客文章 https://github.com/user-attachments/assets/563fd110-5321-49f7-8dc3-48eb0a53e0f9 PoC 实战 root@kitploit: python exploit-citrix-xen.py --target 192.168.1.120 --port 80 --cmd "whoami" / | | |\ \ \ / / \ \ / | | | | / \ /...
CVE-2026-90310
CVE-2026-90310 affects the Linux kernel 's xen/xenbus driver. A race condition exists where the xenstore watch thread (xenwatch ) can trigger xenbus_dev_changed() before the otherend_id field is initialized during device probe (e.g., on module load). The still-zeroed otherend_id is then misinterp...
cve-2024-8069-exp-Citrix-Virtual-Apps-XEN
CVE-2024-8068 and CVE-2024-8069 Citrix 仮想アプリおよびデスクトップ XEN 未認証のリモートコード実行脆弱性 詳細な技術情報については、当社のブログ記事をご覧ください。 https://github.com/user-attachments/assets/563fd110-5321-49f7-8dc3-48eb0a53e0f9 エクスプロイトデモ root@kitploit: python exploit-citrix-xen.py --target 192.168.1.120 --port 80 --cmd "whoami"...
Astra Linux – Vulnerability in Linux
A issue was discovered in the Linux kernel versions 3.2 through 5.10.16, as used by Xen. Grant mapping operations often occur during batch hypercalls, where multiple operations are performed in a single hypercall. The success or failure of each operation is reported to the backend driver, and the...
Astra Linux – Vulnerability in Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: x86/amdnb: The function amdgetmmconfigrange uses rdmsrsafe, which should not be used without proper safeguards. Xen does not provide the MSRFAM10HMMIOCONFbase to all guests. This results in the following warning: Unchecked MSR...
Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1
Closing an event channel in the Linux kernel can lead to a deadlock. This occurs when the closure operation is performed in parallel with an unrelated Xen console action, and the handling of a Xen console interrupt occurs in a unprivileged guest. The closure of an event channel is triggered, for...
Astra Linux – Vulnerability in Linux
In the Linux kernel, the following vulnerability has been resolved: xen/netfront: Destroy queues before realnumtxqueues is zeroed xennetDestroyQueues relies on info-netdev-realnumtxqueues to delete queues. Since d7dac083414eb5bb99a6d2ed53dc2c1b405224e5 “net-sysfs: Update the queue counts in the...
Astra Linux – Vulnerability in Linux
A issue was discovered in the Linux kernel, specifically with versions up to 5.9.1, when used with Xen in versions up to 4.14.x. Users of guest operating systems may experience a denial of service where the host operating system hangs due to a high rate of events affecting dom0, also known as...
Astra Linux – Vulnerability in Linux, Linux 5.10
Rogue backends can cause Denial of Service DoS attacks on guests through high-frequency events. This CNA information record relates to multiple Common Vulnerabilities and Exposures CVEs; the text explains which aspects/vulnerabilities correspond to which CVEs. Xen allows for the execution of PV...
Astra Linux – Vulnerability in Xen
Inappropriate x86 IOMMU timeout detection/handling: IOMMU processes commands that are issued in parallel with the operation of the CPUs that issue those commands. In the current implementation in Xen, asynchronous notifications of the completion of such commands are not used. Instead, the issuing...
Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: 9p/xen: fixed the issue of releasing the IRQ twice. Kernel logs indicate that the IRQ was released twice. The correct device ID must be passed during the IRQ release process. Dominique: removed the confusing variable “reset” to 0...
Astra Linux – Vulnerability in Linux, Linux 5.10
Rogue backends can cause Denial of Service DoS attacks on guests through high-frequency events. This CNA information record relates to multiple Common Vulnerabilities and Exposures CVEs; the text explains which aspects/vulnerabilities correspond to which CVEs. Xen allows for the execution of PV...
Astra Linux – Vulnerability in Xen
Potential speculative code storage bypasses exist in all supported CPU products. Combined with software vulnerabilities related to speculative execution of overwritten instructions, this could lead to incorrect speculation and potentially cause data leakage...
Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: xen-netfront: Added the missing skbmarkforrecycle function. It should be noted that the skbmarkforrecycle function was introduced later than the “fixes” tag in commit 6a5bcd84e886 “pagepool: Allow drivers to hint on SKB recycling...
Astra Linux – Vulnerability in Xen
A issue was discovered in Xen versions 4.9 through 4.14.x. On the ARM architecture, a guest can control whether memory accesses bypass the cache. This means that Xen needs to ensure that all writes such as those during scrubbing have reached the memory before handing over the page to the guest...
CVE-2026-31787
XSA-487 / CVE-2026-31787 Linux 内核 Xenprivcmd 驱动中的双重释放漏洞 Linux 内核 Xen privcmd 驱动中存在的内核内存双重释放漏洞，可导致绕过内核锁定（安全启动）。利用该漏洞需要 root 级访问权限，这限制了其更广泛的安全影响。 | ---|--- 公告| XSA-487 CVE| CVE-2026-31787 组件| Linux 内核 — Xen privcmd 驱动 公开日期| 2026-04-28 发现者| Atharva Vartak @0xAth4rv...
Xen: Improper Handling of HVM Emulation Return Codes (XSA-510)
A guest with a PCI device assigned that has at least a BAR on the IO port space can trigger a BUG in Xen. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if...
Xen: Stale TLB Entry Ahead of Page Scrubbing (XSA-511)
x86 PV guests can free memory pages while still keeping a stale TLB entry pointing to them. A TLB flush is only issued by Xen if needed when the page is re-used. Since it's possible for the page to be scrubbed ahead of the TLB flush, there's a window where a PV guest can modify an already scrubbe...
Xen: x86 DMs May Cause Mem Leak by IRQ Binding (XSA-509)
When guests are terminated, various pieces of cleanup need carrying out. The cleaning up of PCI devices which were assigned to guests, and the associated removal of tracking structures for IRQs used by the devices occurs relatively early in the process. Unfortunately after that point the guest...
