CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2015-8554
https://notcve.org/view.php?id=CVE-2015-8554
Buffer overflow in hw/pt-msi.c in Xen 4.6.x and earlier, when using the qemu-xen-traditional (aka qemu-dm) device model, allows local x86 HVM guest administrators to gain privileges by leveraging a system with access to a passed-through MSI-X capable physical PCI device and MSI-X table entries, related to a "write path." Desbordamiento de buffer en hw/pt-msi.c en Xen 4.6.x y versiones anteriores, cuando se utiliza el modelo de dispositivo qemu-xen-traditional (también conocido como qemu-dm), permite a administradores locales x86 HVM invitados obtener privilegios aprovechando un sistema con acceso a un dispositivo PCI físico con capacidad de paso a través de MSI-X y a entradas de tabla MSI-X, relacionado con una "ruta de escritura". • http://support.citrix.com/article/CTX203879 http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html http://www.securityfocus.com/bid/79579 http://www.securitytracker.com/id/1034481 http://xenbits.xen.org/xsa/advisory-164.html https://security.gentoo.org/glsa/201604-03 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 3.8EPSS: 0%CPEs: 5EXPL: 0CVE-2016-3158
https://notcve.org/view.php?id=CVE-2016-3158
The xrstor function in arch/x86/xstate.c in Xen 4.x does not properly handle writes to the hardware FSW.ES bit when running on AMD64 processors, which allows local guest OS users to obtain sensitive register content information from another guest by leveraging pending exception and mask bits. NOTE: this vulnerability exists because of an incorrect fix for CVE-2013-2076. La función xrstor en arch/x86/xstate.c en Xen 4.x no maneja correctamente escrituras al bit FSW.ES hardware cuando se ejecuta en procesadores AMD64, lo que permite a usuarios locales del SO invitado obtener información sensible del contenido de registro de otro invitado aprovechando una excepción pendiente y bits de máscara. NOTA: esta vulnerabilidad existe por una solución incorrecta para CVE-2013-2076. • http://lists.fedoraproject.org/pipermail/package-announce/2016-April/181699.html http://lists.fedoraproject.org/pipermail/package-announce/2016-April/181729.html http://support.citrix.com/article/CTX209443 http://www.debian.org/security/2016/dsa-3554 http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html http://www.securityfocus.com/bid/85714 http://www.securitytracker.com/id/1035435 http://xenbits.xen.org/xsa/advisory-172.html http://xenbits.xen.org/xsa/xsa172-4 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-284: Improper Access Control •
CVSS: 3.8EPSS: 0%CPEs: 9EXPL: 0CVE-2016-3159
https://notcve.org/view.php?id=CVE-2016-3159
The fpu_fxrstor function in arch/x86/i387.c in Xen 4.x does not properly handle writes to the hardware FSW.ES bit when running on AMD64 processors, which allows local guest OS users to obtain sensitive register content information from another guest by leveraging pending exception and mask bits. NOTE: this vulnerability exists because of an incorrect fix for CVE-2013-2076. La función fpu_fxrstor en arch/x86/i387.c en Xen 4.x no maneja correctamente escrituras al bit FSW.ES hardware cuando se ejecuta en procesadores AMD64, lo que permite a usuarios locales del SO invitado obtener información sensible del contenido de registro de otro invitado aprovechando una excepción pendiente y bits de máscara. NOTA: esta vulnerabilidad existe por una solución incorrecta para CVE-2013-2076. • http://lists.fedoraproject.org/pipermail/package-announce/2016-April/181699.html http://lists.fedoraproject.org/pipermail/package-announce/2016-April/181729.html http://support.citrix.com/article/CTX209443 http://www.debian.org/security/2016/dsa-3554 http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html http://www.securityfocus.com/bid/85716 http://www.securitytracker.com/id/1035435 http://xenbits.xen.org/xsa/advisory-172.html http://xenbits.xen.org/xsa/xsa172.patc • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-284: Improper Access Control •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2016-3157
https://notcve.org/view.php?id=CVE-2016-3157
The __switch_to function in arch/x86/kernel/process_64.c in the Linux kernel does not properly context-switch IOPL on 64-bit PV Xen guests, which allows local guest OS users to gain privileges, cause a denial of service (guest OS crash), or obtain sensitive information by leveraging I/O port access. La función __switch_to en arch/x86/kernel/process_64.c en el kernel de Linux no sustituye correctamente el conmutador de contexto IOPL en invitados 64-bit PV Xen, lo que permite a usuarios locales del SO invitado obtener privilegios, provocar una denegación de servicio (caída del SO invitado), u obtener información sensible aprovechando el puerto de acceso I/O. • http://www.debian.org/security/2016/dsa-3607 http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html http://www.securityfocus.com/bid/84594 http://www.securitytracker.com/id/1035308 http://www.ubuntu.com/usn/USN-2968-1 http://www.ubuntu.com/usn/USN-2968-2 http://www.ubuntu.com/usn/USN-2969-1 http://www.ubuntu.com/usn/USN-2970-1 http://www.ubuntu.com/usn/USN-2971-1 http://www.ubuntu.com/usn/USN-2971-2 http://www.ubun • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 8.6EPSS: 0%CPEs: 17EXPL: 0CVE-2015-8555
https://notcve.org/view.php?id=CVE-2015-8555
Xen 4.6.x, 4.5.x, 4.4.x, 4.3.x, and earlier do not initialize x86 FPU stack and XMM registers when XSAVE/XRSTOR are not used to manage guest extended register state, which allows local guest domains to obtain sensitive information from other domains via unspecified vectors. Xen 4.6.x, 4.5.x, 4.4.x, 4.3.x y versiones anteriores no inicializa registros de memoria de pila x86 FPU y XMM cuando XSAVE/XRSTOR no se utilizan para gestionar el estado del registro extendido de invitado, lo que permite a dominios de invitado local obtener información sensible de otros dominios a través de vectores no especificados. • http://support.citrix.com/article/CTX203879 http://www.debian.org/security/2016/dsa-3519 http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html http://www.securityfocus.com/bid/79543 http://www.securitytracker.com/id/1034477 http://xenbits.xen.org/xsa/advisory-165.html https://security.gentoo.org/glsa/201604-03 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •