CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2015-8554
https://notcve.org/view.php?id=CVE-2015-8554
Buffer overflow in hw/pt-msi.c in Xen 4.6.x and earlier, when using the qemu-xen-traditional (aka qemu-dm) device model, allows local x86 HVM guest administrators to gain privileges by leveraging a system with access to a passed-through MSI-X capable physical PCI device and MSI-X table entries, related to a "write path." Desbordamiento de buffer en hw/pt-msi.c en Xen 4.6.x y versiones anteriores, cuando se utiliza el modelo de dispositivo qemu-xen-traditional (también conocido como qemu-dm), permite a administradores locales x86 HVM invitados obtener privilegios aprovechando un sistema con acceso a un dispositivo PCI físico con capacidad de paso a través de MSI-X y a entradas de tabla MSI-X, relacionado con una "ruta de escritura". • http://support.citrix.com/article/CTX203879 http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html http://www.securityfocus.com/bid/79579 http://www.securitytracker.com/id/1034481 http://xenbits.xen.org/xsa/advisory-164.html https://security.gentoo.org/glsa/201604-03 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 3.8EPSS: 0%CPEs: 5EXPL: 0CVE-2016-3158
https://notcve.org/view.php?id=CVE-2016-3158
The xrstor function in arch/x86/xstate.c in Xen 4.x does not properly handle writes to the hardware FSW.ES bit when running on AMD64 processors, which allows local guest OS users to obtain sensitive register content information from another guest by leveraging pending exception and mask bits. NOTE: this vulnerability exists because of an incorrect fix for CVE-2013-2076. La función xrstor en arch/x86/xstate.c en Xen 4.x no maneja correctamente escrituras al bit FSW.ES hardware cuando se ejecuta en procesadores AMD64, lo que permite a usuarios locales del SO invitado obtener información sensible del contenido de registro de otro invitado aprovechando una excepción pendiente y bits de máscara. NOTA: esta vulnerabilidad existe por una solución incorrecta para CVE-2013-2076. • http://lists.fedoraproject.org/pipermail/package-announce/2016-April/181699.html http://lists.fedoraproject.org/pipermail/package-announce/2016-April/181729.html http://support.citrix.com/article/CTX209443 http://www.debian.org/security/2016/dsa-3554 http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html http://www.securityfocus.com/bid/85714 http://www.securitytracker.com/id/1035435 http://xenbits.xen.org/xsa/advisory-172.html http://xenbits.xen.org/xsa/xsa172-4 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-284: Improper Access Control •
CVSS: 6.8EPSS: 0%CPEs: 6EXPL: 0CVE-2016-2270
https://notcve.org/view.php?id=CVE-2016-2270
Xen 4.6.x and earlier allows local guest administrators to cause a denial of service (host reboot) via vectors related to multiple mappings of MMIO pages with different cachability settings. Xen 4.6.x y versiones anteriores permite a administradores invitados locales provocar una denegación de servicio (reinicio de host) a través de vectores relacionados con múltiples mapeos de páginas MMIO con diferentes ajustes de cacheado. • http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177990.html http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178518.html http://www.debian.org/security/2016/dsa-3519 http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html http://www.securitytracker.com/id/1035042 http://xenbits.xen.org/xsa/advisory-154.html https://security.gentoo.org/glsa/201604-03 • CWE-20: Improper Input Validation •
CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 0CVE-2015-8338
https://notcve.org/view.php?id=CVE-2015-8338
Xen 4.6.x and earlier does not properly enforce limits on page order inputs for the (1) XENMEM_increase_reservation, (2) XENMEM_populate_physmap, (3) XENMEM_exchange, and possibly other HYPERVISOR_memory_op suboperations, which allows ARM guest OS administrators to cause a denial of service (CPU consumption, guest reboot, or watchdog timeout and host reboot) and possibly have unspecified other impact via unknown vectors. Xen 4.6.x y versiones anteriores no impone adecuadamente límites en órdenes de entrada de página para las suboperaciones (1) XENMEM_increase_reservation, (2) XENMEM_populate_physmap, (3) XENMEM_exchange y posiblemente otra HYPERVISOR_memory_op, lo que permite a administradores ARM invitados del SO causar una denegación de servicio (consumo de CPU, reinicio de invitado o tiempo de watchdog excedido o reinicio host) y posiblemente tener otro impacto no especificado a través de vectores desconocidos. • http://www.debian.org/security/2016/dsa-3633 http://www.securityfocus.com/bid/78920 http://www.securitytracker.com/id/1034390 http://xenbits.xen.org/xsa/advisory-158.html • CWE-254: 7PK - Security Features •
CVSS: 4.7EPSS: 0%CPEs: 1EXPL: 0CVE-2015-7814
https://notcve.org/view.php?id=CVE-2015-7814
Race condition in the relinquish_memory function in arch/arm/domain.c in Xen 4.6.x and earlier allows local domains with partial management control to cause a denial of service (host crash) via vectors involving the destruction of a domain and using XENMEM_decrease_reservation to reduce the memory of the domain. Condición de carrera en la función relinquish_memory en arch/arm/domain.c en Xen 4.6.x y versiones anteriores permite a dominios locales con control parcial de la gestión provocar una denegación de servicio (caída del host) a través de vectores relacionados con la destrucción de un dominio y utilizando XENMEM_decrease_reservation para reducir la memoria del dominio. • http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171082.html http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171185.html http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171249.html http://www.debian.org/security/2015/dsa-3414 http://www.securitytracker.com/id/1034030 http://xenbits.xen.org/xsa/advisory-147.html https://security.gentoo.org/glsa/201604-03 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •