CVSS: 7.9EPSS: 0%CPEs: 20EXPL: 3CVE-2012-0217 – FreeBSD - Intel SYSRET Privilege Escalation
https://notcve.org/view.php?id=CVE-2012-0217
The x86-64 kernel system-call functionality in Xen 4.1.2 and earlier, as used in Citrix XenServer 6.0.2 and earlier and other products; Oracle Solaris 11 and earlier; illumos before r13724; Joyent SmartOS before 20120614T184600Z; FreeBSD before 9.0-RELEASE-p3; NetBSD 6.0 Beta and earlier; Microsoft Windows Server 2008 R2 and R2 SP1 and Windows 7 Gold and SP1; and possibly other operating systems, when running on an Intel processor, incorrectly uses the sysret path in cases where a certain address is not a canonical address, which allows local users to gain privileges via a crafted application. NOTE: because this issue is due to incorrect use of the Intel specification, it should have been split into separate identifiers; however, there was some value in preserving the original mapping of the multi-codebase coordinated-disclosure effort to a single identifier. El modo de usuario Scheduler en el núcleo en Microsoft Windows Server v2008 R2 y R2 SP1 y Windows v7 Gold y SP1 sobre la plataforma x64 no maneja adecuadamente solicitudes del sistema, lo que permite a usuarios locales obtener privilegios a través de una aplicación modificada, también conocida como "vulnerabilidad de corrupción de memoria de modo de usuario Scheduler". It was found that the Xen hypervisor implementation as shipped with Red Hat Enterprise Linux 5 did not properly restrict the syscall return addresses in the sysret return path to canonical addresses. An unprivileged user in a 64-bit para-virtualized guest, that is running on a 64-bit host that has an Intel CPU, could use this flaw to crash the host or, potentially, escalate their privileges, allowing them to execute arbitrary code at the hypervisor level. • https://www.exploit-db.com/exploits/46508 https://www.exploit-db.com/exploits/28718 https://www.exploit-db.com/exploits/20861 http://blog.illumos.org/2012/06/14/illumos-vulnerability-patched http://blog.xen.org/index.php/2012/06/13/the-intel-sysret-privilege-escalation http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2012-003.txt.asc http://lists.xen.org/archives/html/xen-announce/2012-06/msg00001.html http://lists.xen.org/archives/html/xen-devel/2012-06 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 5.2EPSS: 0%CPEs: 1EXPL: 1CVE-2011-3131 – kernel: xen: IOMMU fault livelock
https://notcve.org/view.php?id=CVE-2011-3131
Xen 4.1.1 and earlier allows local guest OS kernels with control of a PCI[E] device to cause a denial of service (CPU consumption and host hang) via many crafted DMA requests that are denied by the IOMMU, which triggers a livelock. Xen v4.1.1 y anteriores permite causar una denegación de servicio (consumo de CPU y bloqueo de Xen) a los kernels de sistemas operativos huesped que controlan dispositivos PCI[E] a través de muchas peticiones DMA modificadas que son denegadas por la IOMMU, lo que desencadena un bloqueo activo. • http://old-list-archives.xen.org/archives/html/xen-devel/2011-06/msg01106.html http://old-list-archives.xen.org/archives/html/xen-devel/2011-08/msg00450.html http://secunia.com/advisories/45622 http://secunia.com/advisories/51468 http://www.debian.org/security/2012/dsa-2582 http://www.securityfocus.com/bid/49146 http://xenbits.xen.org/hg/staging/xen-4.1-testing.hg/rev/84e3706df07a https://access.redhat.com/security/cve/CVE-2011-3131 https://bugzilla.redhat.com/show& • CWE-399: Resource Management Errors •
CVSS: 6.0EPSS: 0%CPEs: 4EXPL: 0CVE-2011-3262 – xen: insufficiencies in pv kernel image validation
https://notcve.org/view.php?id=CVE-2011-3262
tools/libxc/xc_dom_bzimageloader.c in Xen 3.2, 3.3, 4.0, and 4.1 allows local users to cause a denial of service (management software infinite loop and management domain resource consumption) via unspecified vectors related to "Lack of error checking in the decompression loop." tools/libxc/xc_dom_bzimageloader.c en Xen v3.2, v3.3, v4.0 y v4.1 permite a usuarios locales provocar una denegación de servicio (bucle infinito de software de gestión y excesivo consumo de recursos en el administrador de dominios) a través de vectores no especificados relacionados con "La falta de comprobación de errores en el bucle de descompresión". • http://lists.xensource.com/archives/html/xen-devel/2011-05/msg00483.html http://lists.xensource.com/archives/html/xen-devel/2011-05/msg00491.html http://secunia.com/advisories/55082 http://security.gentoo.org/glsa/glsa-201309-24.xml https://exchange.xforce.ibmcloud.com/vulnerabilities/69381 https://access.redhat.com/security/cve/CVE-2011-3262 https://bugzilla.redhat.com/show_bug.cgi?id=696927 • CWE-399: Resource Management Errors •
CVSS: 7.4EPSS: 0%CPEs: 3EXPL: 1CVE-2011-1898 – virt: VT-d (PCI passthrough) MSI trap injection
https://notcve.org/view.php?id=CVE-2011-1898
Xen 4.1 before 4.1.1 and 4.0 before 4.0.2, when using PCI passthrough on Intel VT-d chipsets that do not have interrupt remapping, allows guest OS users to gain host OS privileges by "using DMA to generate MSI interrupts by writing to the interrupt injection registers." Xen v4.1 anterior a v4.1.1 y v4.0 anterior a v4.0.2, cuando usa PCI passthrough sobre chipsets Intel VT-d que no tienen que interrumplir remapeado, permite a usuarios invitados del OS obtener privilegios de anfitrión "usando DMA para generar interrupciones MSI escribiendo en el registro de inyección de interrupció"n. • http://lists.fedoraproject.org/pipermail/package-announce/2011-June/062112.html http://lists.fedoraproject.org/pipermail/package-announce/2011-June/062139.html http://lists.opensuse.org/opensuse-security-announce/2011-08/msg00017.html http://lists.opensuse.org/opensuse-security-announce/2011-08/msg00018.html http://theinvisiblethings.blogspot.com/2011/05/following-white-rabbit-software-attacks.html http://www.invisiblethingslab.com/resources/2011/Software%20Attacks%20on%20Intel%20VT-d.pdf http://xen.1045712.n5.na • CWE-264: Permissions, Privileges, and Access Controls CWE-284: Improper Access Control •
CVSS: 6.9EPSS: 0%CPEs: 4EXPL: 0CVE-2011-1583 – xen: insufficiencies in pv kernel image validation
https://notcve.org/view.php?id=CVE-2011-1583
Multiple integer overflows in tools/libxc/xc_dom_bzimageloader.c in Xen 3.2, 3.3, 4.0, and 4.1 allow local users to cause a denial of service and possibly execute arbitrary code via a crafted paravirtualised guest kernel image that triggers (1) a buffer overflow during a decompression loop or (2) an out-of-bounds read in the loader involving unspecified length fields. Múltiples desbordamientos de entero en tools/libxc/xc_dom_bzimageloader.c en Xen v3.2, v3.3, v4.0, y v4.1 permite a usuarios locales provocar una denegación de servicio y posiblemente ejecutar código de su elección a través de invitados "paravirtualizados" manipulados en la imagen del kernel que dispara (1) un desbordamiento de búfer durante la descompresión de bucle o (2) una lectura fuera de límites en el cargador envolviendo un campo de longitud no especificada. • http://lists.xensource.com/archives/html/xen-devel/2011-05/msg00483.html http://lists.xensource.com/archives/html/xen-devel/2011-05/msg00491.html http://rhn.redhat.com/errata/RHSA-2011-0496.html https://access.redhat.com/security/cve/CVE-2011-1583 https://bugzilla.redhat.com/show_bug.cgi?id=696927 • CWE-189: Numeric Errors •