CVSS: 6.5EPSS: 0%CPEs: 18EXPL: 0CVE-2017-14318
https://notcve.org/view.php?id=CVE-2017-14318
An issue was discovered in Xen 4.5.x through 4.9.x. The function `__gnttab_cache_flush` handles GNTTABOP_cache_flush grant table operations. It checks to see if the calling domain is the owner of the page that is to be operated on. If it is not, the owner's grant table is checked to see if a grant mapping to the calling domain exists for the page in question. However, the function does not check to see if the owning domain actually has a grant table or not. • http://www.securityfocus.com/bid/100817 http://www.securitytracker.com/id/1039349 http://xenbits.xen.org/xsa/advisory-232.html https://support.citrix.com/article/CTX227185 https://www.debian.org/security/2017/dsa-4050 • CWE-476: NULL Pointer Dereference •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2017-14319
https://notcve.org/view.php?id=CVE-2017-14319
A grant unmapping issue was discovered in Xen through 4.9.x. When removing or replacing a grant mapping, the x86 PV specific path needs to make sure page table entries remain in sync with other accounting done. Although the identity of the page frame was validated correctly, neither the presence of the mapping nor page writability were taken into account. Se ha descubierto un problema de desasignación de concesión en Xen hasta la versión 4.9.x. Cuando se elimina o reemplaza una asignación de concesión, la ruta específica de la PV x86 necesita asegurarse de que las entradas de tabla de página siguen sincronizadas con otras cuentas realizadas. • http://www.securityfocus.com/bid/100819 http://www.securitytracker.com/id/1039351 http://xenbits.xen.org/xsa/advisory-234.html https://lists.debian.org/debian-lts-announce/2018/10/msg00009.html https://support.citrix.com/article/CTX227185 https://www.debian.org/security/2017/dsa-4050 •
CVSS: 6.5EPSS: 0%CPEs: 18EXPL: 0CVE-2017-12855
https://notcve.org/view.php?id=CVE-2017-12855
Xen maintains the _GTF_{read,writ}ing bits as appropriate, to inform the guest that a grant is in use. A guest is expected not to modify the grant details while it is in use, whereas the guest is free to modify/reuse the grant entry when it is not in use. Under some circumstances, Xen will clear the status bits too early, incorrectly informing the guest that the grant is no longer in use. A guest may prematurely believe that a granted frame is safely private again, and reuse it in a way which contains sensitive information, while the domain on the far end of the grant is still using the grant. Xen 4.9, 4.8, 4.7, 4.6, and 4.5 are affected. • http://www.debian.org/security/2017/dsa-3969 http://www.securityfocus.com/bid/100341 http://www.securitytracker.com/id/1039177 http://xenbits.xen.org/xsa/advisory-230.html https://support.citrix.com/article/CTX225941 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2017-10919
https://notcve.org/view.php?id=CVE-2017-10919
Xen through 4.8.x mishandles virtual interrupt injection, which allows guest OS users to cause a denial of service (hypervisor crash), aka XSA-223. Xen hasta la versión 4.8.x, maneja inapropiadamente la inyección de interrupción virtual, que permite a los usuarios del sistema operativo invitado causar una denegación de servicio (bloqueo del hypervisor), también se conoce como XSA-223. • http://www.debian.org/security/2017/dsa-3969 http://www.securityfocus.com/bid/99159 http://www.securitytracker.com/id/1038733 https://security.gentoo.org/glsa/201708-03 https://xenbits.xen.org/xsa/advisory-223.html •
CVSS: 7.5EPSS: 0%CPEs: 13EXPL: 0CVE-2017-10916
https://notcve.org/view.php?id=CVE-2017-10916
The vCPU context-switch implementation in Xen through 4.8.x improperly interacts with the Memory Protection Extensions (MPX) and Protection Key (PKU) features, which makes it easier for guest OS users to defeat ASLR and other protection mechanisms, aka XSA-220. La implementación context-switch de vCPU en Xen hasta la versión 4.8.x, interactúa inapropiadamente con las funcionalidades Memory Protection Extensions (MPX) y Protection Key (PKU), lo que facilita a los usuarios del sistema operativo invitado superar a la ASLR y a otros mecanismos de protección, también se conoce como XSA-220. • http://www.debian.org/security/2017/dsa-3969 http://www.securityfocus.com/bid/99167 http://www.securitytracker.com/id/1038730 https://security.gentoo.org/glsa/201708-03 https://xenbits.xen.org/xsa/advisory-220.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •