CVSS: 5.6EPSS: 0%CPEs: 1EXPL: 0CVE-2017-14317
https://notcve.org/view.php?id=CVE-2017-14317
A domain cleanup issue was discovered in the C xenstore daemon (aka cxenstored) in Xen through 4.9.x. When shutting down a VM with a stubdomain, a race in cxenstored may cause a double-free. The xenstored daemon may crash, resulting in a DoS of any parts of the system relying on it (including domain creation / destruction, ballooning, device changes, etc.). Se ha descubierto un problema de limpieza de dominio en el demonio C xenstore (también conocido como cxenstored) en Xen hasta la versión 4.9.x. Cuando se apaga una VM con un dominio stub, una carrera en cxenstored podría causar una liberación doble (double-free). • http://www.securityfocus.com/bid/100826 http://www.securitytracker.com/id/1039350 http://xenbits.xen.org/xsa/advisory-233.html https://lists.debian.org/debian-lts-announce/2018/10/msg00009.html https://www.debian.org/security/2017/dsa-4050 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2017-14316
https://notcve.org/view.php?id=CVE-2017-14316
A parameter verification issue was discovered in Xen through 4.9.x. The function `alloc_heap_pages` allows callers to specify the first NUMA node that should be used for allocations through the `memflags` parameter; the node is extracted using the `MEMF_get_node` macro. While the function checks to see if the special constant `NUMA_NO_NODE` is specified, it otherwise does not handle the case where `node >= MAX_NUMNODES`. This allows an out-of-bounds access to an internal array. Existe un problema de verificación de parámetros en Xen hasta la versión 4.9.x. • http://www.securityfocus.com/bid/100818 http://www.securitytracker.com/id/1039348 http://xenbits.xen.org/xsa/advisory-231.html https://lists.debian.org/debian-lts-announce/2018/10/msg00009.html https://support.citrix.com/article/CTX227185 https://www.debian.org/security/2017/dsa-4050 • CWE-125: Out-of-bounds Read •
CVSS: 6.5EPSS: 0%CPEs: 18EXPL: 0CVE-2017-12855
https://notcve.org/view.php?id=CVE-2017-12855
Xen maintains the _GTF_{read,writ}ing bits as appropriate, to inform the guest that a grant is in use. A guest is expected not to modify the grant details while it is in use, whereas the guest is free to modify/reuse the grant entry when it is not in use. Under some circumstances, Xen will clear the status bits too early, incorrectly informing the guest that the grant is no longer in use. A guest may prematurely believe that a granted frame is safely private again, and reuse it in a way which contains sensitive information, while the domain on the far end of the grant is still using the grant. Xen 4.9, 4.8, 4.7, 4.6, and 4.5 are affected. • http://www.debian.org/security/2017/dsa-3969 http://www.securityfocus.com/bid/100341 http://www.securitytracker.com/id/1039177 http://xenbits.xen.org/xsa/advisory-230.html https://support.citrix.com/article/CTX225941 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2017-10922
https://notcve.org/view.php?id=CVE-2017-10922
The grant-table feature in Xen through 4.8.x mishandles MMIO region grant references, which allows guest OS users to cause a denial of service (loss of grant trackability), aka XSA-224 bug 3. La característica de tabla grant en Xen, hasta las versiones 4.8.x, gestiona de manera incorrecta referencias grant de la región MMIO, lo que permite que los usuarios invitados de sistema operativo provoquen una denegación de servicio (pérdida de trazabilidad de grant, también conocido como XSA-224, fallo 3. • http://www.debian.org/security/2017/dsa-3969 http://www.securitytracker.com/id/1038734 https://security.gentoo.org/glsa/201708-03 https://security.gentoo.org/glsa/201710-17 https://xenbits.xen.org/xsa/advisory-224.html • CWE-400: Uncontrolled Resource Consumption •
CVSS: 9.4EPSS: 0%CPEs: 1EXPL: 0CVE-2017-10917
https://notcve.org/view.php?id=CVE-2017-10917
Xen through 4.8.x does not validate the port numbers of polled event channel ports, which allows guest OS users to cause a denial of service (NULL pointer dereference and host OS crash) or possibly obtain sensitive information, aka XSA-221. Xen hasta la versión 4.8.x, no comprueba los números de puerto de los puertos del canal de eventos sondeados, lo que permite a los usuarios del sistema operativo invitado causar una denegación de servicio (desreferencia del puntero NULL y bloqueo del sistema operativo del host) o posiblemente obtener información confidencial, también se conoce como XSA-221. • http://www.debian.org/security/2017/dsa-3969 http://www.securityfocus.com/bid/99157 http://www.securitytracker.com/id/1038731 https://security.gentoo.org/glsa/201708-03 https://xenbits.xen.org/xsa/advisory-221.html • CWE-476: NULL Pointer Dereference •