LOW1.7
Уязвимость гипервизора Xen, позволяющая нарушителю получить доступ к защищаемой информации содержимого регистра
CVSS 2.0НИЗКАЯ 1.7
CVSS:2.0/AV:L/AC:L/Au:S/C:P/I:N/A:N
Серьёзность:
Закрытые проблемы (19)
MEDIUM6.7
The HVMOP_set_mem_type control in Xen 4.1 through 4.4.x allows local guest HVM administrators to cause a denial of service (hypervisor crash) or possibly execute arbitrary code by leveraging a separate qemu-dm vulnerability to trigger invalid page table translations for unspecified memory page types.
CVSS 2.0СРЕДНЯЯ 6.7
CVSS:2.0/AV:A/AC:L/Au:S/C:P/I:P/A:CСсылки
- http://lists.fedoraproject.org/pipermail/package-announce/2014-May/133148.html
- http://lists.fedoraproject.org/pipermail/package-announce/2014-May/133191.html
- http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00003.html
- http://security.gentoo.org/glsa/glsa-201407-03.xml
- http://www.debian.org/security/2014/dsa-3006
- http://www.openwall.com/lists/oss-security/2014/04/29/1
- http://www.openwall.com/lists/oss-security/2014/04/30/10
- http://www.securityfocus.com/bid/67113
- http://www.securitytracker.com/id/1030160
- http://xenbits.xen.org/xsa/advisory-92.html
- http://lists.fedoraproject.org/pipermail/package-announce/2014-May/133148.html
- http://lists.fedoraproject.org/pipermail/package-announce/2014-May/133191.html
- http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00003.html
- http://security.gentoo.org/glsa/glsa-201407-03.xml
- http://www.debian.org/security/2014/dsa-3006
- http://www.openwall.com/lists/oss-security/2014/04/29/1
- http://www.openwall.com/lists/oss-security/2014/04/30/10
- http://www.securityfocus.com/bid/67113
- http://www.securitytracker.com/id/1030160
- http://xenbits.xen.org/xsa/advisory-92.html
LOW3.3
The ARM image loading functionality in Xen 4.4.x does not properly validate kernel length, which allows local users to read system memory or cause a denial of service (crash) via a crafted 32-bit ARM guest kernel in an image, which triggers a buffer overflow.
CVSS 2.0НИЗКАЯ 3.3
CVSS:2.0/AV:L/AC:M/Au:N/C:P/I:N/A:PСсылки
- http://www.openwall.com/lists/oss-security/2014/05/14/4
- http://www.openwall.com/lists/oss-security/2014/05/15/6
- http://www.openwall.com/lists/oss-security/2014/05/16/1
- http://www.securitytracker.com/id/1030252
- http://xenbits.xen.org/xsa/advisory-95.html
- http://www.openwall.com/lists/oss-security/2014/05/14/4
- http://www.openwall.com/lists/oss-security/2014/05/15/6
- http://www.openwall.com/lists/oss-security/2014/05/16/1
- http://www.securitytracker.com/id/1030252
- http://xenbits.xen.org/xsa/advisory-95.html
LOW3.3
Buffer overflow in Xen 4.4.x allows local users to read system memory or cause a denial of service (crash) via a crafted 32-bit guest kernel, related to searching for an appended DTB.
CVSS 2.0НИЗКАЯ 3.3
CVSS:2.0/AV:L/AC:M/Au:N/C:P/I:N/A:PСсылки
- http://www.openwall.com/lists/oss-security/2014/05/14/4
- http://www.openwall.com/lists/oss-security/2014/05/15/6
- http://www.openwall.com/lists/oss-security/2014/05/16/1
- http://www.securitytracker.com/id/1030252
- http://xenbits.xen.org/xsa/advisory-95.html
- http://www.openwall.com/lists/oss-security/2014/05/14/4
- http://www.openwall.com/lists/oss-security/2014/05/15/6
- http://www.openwall.com/lists/oss-security/2014/05/16/1
- http://www.securitytracker.com/id/1030252
- http://xenbits.xen.org/xsa/advisory-95.html
LOW1.9
Xen 4.4.x does not properly check alignment, which allows local users to cause a denial of service (crash) via an unspecified field in a DTB header in a 32-bit guest kernel.
CVSS 2.0НИЗКАЯ 1.9
CVSS:2.0/AV:L/AC:M/Au:N/C:N/I:N/A:PСсылки
- http://www.openwall.com/lists/oss-security/2014/05/14/4
- http://www.openwall.com/lists/oss-security/2014/05/15/6
- http://www.openwall.com/lists/oss-security/2014/05/16/1
- http://www.securitytracker.com/id/1030252
- http://xenbits.xen.org/xsa/advisory-95.html
- http://www.openwall.com/lists/oss-security/2014/05/14/4
- http://www.openwall.com/lists/oss-security/2014/05/15/6
- http://www.openwall.com/lists/oss-security/2014/05/16/1
- http://www.securitytracker.com/id/1030252
- http://xenbits.xen.org/xsa/advisory-95.html
LOW3.3
Xen 4.4.x does not properly validate the load address for 64-bit ARM guest kernels, which allows local users to read system memory or cause a denial of service (crash) via a crafted kernel, which triggers a buffer overflow.
CVSS 2.0НИЗКАЯ 3.3
CVSS:2.0/AV:L/AC:M/Au:N/C:P/I:N/A:PСсылки
- http://www.openwall.com/lists/oss-security/2014/05/14/4
- http://www.openwall.com/lists/oss-security/2014/05/15/6
- http://www.openwall.com/lists/oss-security/2014/05/16/1
- http://www.securitytracker.com/id/1030252
- http://xenbits.xen.org/xsa/advisory-95.html
- http://www.openwall.com/lists/oss-security/2014/05/14/4
- http://www.openwall.com/lists/oss-security/2014/05/15/6
- http://www.openwall.com/lists/oss-security/2014/05/16/1
- http://www.securitytracker.com/id/1030252
- http://xenbits.xen.org/xsa/advisory-95.html
MEDIUM5.5
The HVMOP_inject_msi function in Xen 4.2.x, 4.3.x, and 4.4.x does not properly check the return value from the IRQ setup check, which allows local HVM guest administrators to cause a denial of service (NULL pointer dereference and crash) via unspecified vectors.
CVSS 2.0СРЕДНЯЯ 5.5
CVSS:2.0/AV:A/AC:L/Au:S/C:N/I:N/A:CСсылки
- http://lists.fedoraproject.org/pipermail/package-announce/2014-June/134710.html
- http://lists.fedoraproject.org/pipermail/package-announce/2014-June/134739.html
- http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00002.html
- http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00003.html
- http://www.openwall.com/lists/oss-security/2014/06/04/13
- http://www.securityfocus.com/bid/67794
- http://www.securitytracker.com/id/1030322
- http://xenbits.xen.org/xsa/advisory-96.html
- https://security.gentoo.org/glsa/201504-04
- http://lists.fedoraproject.org/pipermail/package-announce/2014-June/134710.html
- http://lists.fedoraproject.org/pipermail/package-announce/2014-June/134739.html
- http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00002.html
- http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00003.html
- http://www.openwall.com/lists/oss-security/2014/06/04/13
- http://www.securityfocus.com/bid/67794
- http://www.securitytracker.com/id/1030322
- http://xenbits.xen.org/xsa/advisory-96.html
- https://security.gentoo.org/glsa/201504-04
MEDIUM5.5
The HVMOP_inject_msi function in Xen 4.2.x, 4.3.x, and 4.4.x allows local guest HVM administrators to cause a denial of service (host crash) via a large number of crafted requests, which trigger an error messages to be logged.
CVSS 2.0СРЕДНЯЯ 5.5
CVSS:2.0/AV:A/AC:L/Au:S/C:N/I:N/A:CСсылки
- http://lists.fedoraproject.org/pipermail/package-announce/2014-June/134710.html
- http://lists.fedoraproject.org/pipermail/package-announce/2014-June/134739.html
- http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00002.html
- http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00003.html
- http://www.openwall.com/lists/oss-security/2014/06/04/13
- http://www.securityfocus.com/bid/67794
- http://www.securityfocus.com/bid/67824
- http://www.securitytracker.com/id/1030322
- http://xenbits.xen.org/xsa/advisory-96.html
- https://security.gentoo.org/glsa/201504-04
- http://lists.fedoraproject.org/pipermail/package-announce/2014-June/134710.html
- http://lists.fedoraproject.org/pipermail/package-announce/2014-June/134739.html
- http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00002.html
- http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00003.html
- http://www.openwall.com/lists/oss-security/2014/06/04/13
- http://www.securityfocus.com/bid/67794
- http://www.securityfocus.com/bid/67824
- http://www.securitytracker.com/id/1030322
- http://xenbits.xen.org/xsa/advisory-96.html
- https://security.gentoo.org/glsa/201504-04
HIGH7.4
Xen 4.4.x, when running on an ARM system, does not properly check write permissions on virtual addresses, which allows local guest administrators to gain privileges via unspecified vectors.
CVSS 2.0ВЫСОКАЯ 7.4
CVSS:2.0/AV:A/AC:M/Au:S/C:C/I:C/A:CСсылки
- http://secunia.com/advisories/58975
- http://www.openwall.com/lists/oss-security/2014/06/04/14
- http://www.securityfocus.com/bid/67819
- http://www.securitytracker.com/id/1030333
- http://xenbits.xen.org/xsa/advisory-98.html
- http://secunia.com/advisories/58975
- http://www.openwall.com/lists/oss-security/2014/06/04/14
- http://www.securityfocus.com/bid/67819
- http://www.securitytracker.com/id/1030333
- http://xenbits.xen.org/xsa/advisory-98.html
LOW2.7
Xen 3.2.x through 4.4.x does not properly clean memory pages recovered from guests, which allows local guest OS users to obtain sensitive information via unspecified vectors.
CVSS 2.0НИЗКАЯ 2.7
CVSS:2.0/AV:A/AC:L/Au:S/C:P/I:N/A:NСсылки
- http://linux.oracle.com/errata/ELSA-2014-0926-1.html
- http://linux.oracle.com/errata/ELSA-2014-0926.html
- http://lists.fedoraproject.org/pipermail/package-announce/2014-July/135068.html
- http://lists.fedoraproject.org/pipermail/package-announce/2014-July/135071.html
- http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00002.html
- http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00003.html
- http://secunia.com/advisories/59208
- http://secunia.com/advisories/60027
- http://secunia.com/advisories/60130
- http://secunia.com/advisories/60471
- http://security.gentoo.org/glsa/glsa-201407-03.xml
- http://support.citrix.com/article/CTX140984
- http://www.debian.org/security/2014/dsa-3006
- http://www.securityfocus.com/bid/68070
- http://www.securitytracker.com/id/1030442
- http://xenbits.xen.org/xsa/advisory-100.html
- http://linux.oracle.com/errata/ELSA-2014-0926-1.html
- http://linux.oracle.com/errata/ELSA-2014-0926.html
- http://lists.fedoraproject.org/pipermail/package-announce/2014-July/135068.html
- http://lists.fedoraproject.org/pipermail/package-announce/2014-July/135071.html
- http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00002.html
- http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00003.html
- http://secunia.com/advisories/59208
- http://secunia.com/advisories/60027
- http://secunia.com/advisories/60130
- http://secunia.com/advisories/60471
- http://security.gentoo.org/glsa/glsa-201407-03.xml
- http://support.citrix.com/article/CTX140984
- http://www.debian.org/security/2014/dsa-3006
- http://www.securityfocus.com/bid/68070
- http://www.securitytracker.com/id/1030442
- http://xenbits.xen.org/xsa/advisory-100.html
LOW2.7
The alloc_domain_struct function in arch/arm/domain.c in Xen 4.4.x, when running on an ARM platform, does not properly initialize the structure containing the grant table pages for a domain, which allows local guest administrators to obtain sensitive information via the GNTTABOP_setup_table subhypercall.
CVSS 2.0НИЗКАЯ 2.7
CVSS:2.0/AV:A/AC:L/Au:S/C:P/I:N/A:NСсылки
- http://secunia.com/advisories/59523
- http://www.securityfocus.com/bid/68184
- http://www.securitytracker.com/id/1030471
- http://xenbits.xen.org/xsa/advisory-101.html
- http://secunia.com/advisories/59523
- http://www.securityfocus.com/bid/68184
- http://www.securitytracker.com/id/1030471
- http://xenbits.xen.org/xsa/advisory-101.html
MEDIUM4.7
Certain MMU virtualization operations in Xen 4.2.x through 4.4.x before the xsa97-hap patch, when using Hardware Assisted Paging (HAP), are not preemptible, which allows local HVM guest to cause a denial of service (vcpu consumption) by invoking these operations, which process every page assigned to a guest, a different vulnerability than CVE-2014-5149.
CVSS 2.0СРЕДНЯЯ 4.7
CVSS:2.0/AV:L/AC:M/Au:N/C:N/I:N/A:CСсылки
- http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136980.html
- http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136981.html
- http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00005.html
- http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00010.html
- http://www.securityfocus.com/bid/69198
- http://www.securitytracker.com/id/1030723
- http://xenbits.xen.org/xsa/advisory-97.html
- https://exchange.xforce.ibmcloud.com/vulnerabilities/95234
- https://security.gentoo.org/glsa/201504-04
- http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136980.html
- http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136981.html
- http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00005.html
- http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00010.html
- http://www.securityfocus.com/bid/69198
- http://www.securitytracker.com/id/1030723
- http://xenbits.xen.org/xsa/advisory-97.html
- https://exchange.xforce.ibmcloud.com/vulnerabilities/95234
- https://security.gentoo.org/glsa/201504-04
MEDIUM4.3
Xen 4.4.x, when running a 64-bit kernel on an ARM system, does not properly handle traps from the guest domain that use a different address width, which allows local guest users to cause a denial of service (host crash) via a crafted 32-bit process.
CVSS 2.0СРЕДНЯЯ 4.3
CVSS:2.0/AV:A/AC:H/Au:S/C:N/I:N/A:CMEDIUM4.7
Certain MMU virtualization operations in Xen 4.2.x through 4.4.x, when using shadow pagetables, are not preemptible, which allows local HVM guest to cause a denial of service (vcpu consumption) by invoking these operations, which process every page assigned to a guest, a different vulnerability than CVE-2014-5146.
CVSS 2.0СРЕДНЯЯ 4.7
CVSS:2.0/AV:L/AC:M/Au:N/C:N/I:N/A:CСсылки
- http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136980.html
- http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136981.html
- http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00005.html
- http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00010.html
- http://www.securityfocus.com/bid/69199
- http://www.securitytracker.com/id/1030723
- http://xenbits.xen.org/xsa/advisory-97.html
- https://exchange.xforce.ibmcloud.com/vulnerabilities/95235
- https://security.gentoo.org/glsa/201504-04
- http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136980.html
- http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136981.html
- http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00005.html
- http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00010.html
- http://www.securityfocus.com/bid/69199
- http://www.securitytracker.com/id/1030723
- http://xenbits.xen.org/xsa/advisory-97.html
- https://exchange.xforce.ibmcloud.com/vulnerabilities/95235
- https://security.gentoo.org/glsa/201504-04
MEDIUM5.8
The x86_emulate function in arch/x86/x86_emulate/x86_emulate.c in Xen 4.4.x and earlier does not properly check supervisor mode permissions, which allows local HVM users to cause a denial of service (guest crash) or gain guest kernel mode privileges via vectors involving an (1) HLT, (2) LGDT, (3) LIDT, or (4) LMSW instruction.
CVSS 2.0СРЕДНЯЯ 5.8
CVSS:2.0/AV:A/AC:L/Au:N/C:P/I:P/A:PСсылки
- http://lists.fedoraproject.org/pipermail/package-announce/2014-October/140418.html
- http://lists.fedoraproject.org/pipermail/package-announce/2014-October/140483.html
- http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00002.html
- http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00003.html
- http://secunia.com/advisories/61858
- http://secunia.com/advisories/61890
- http://security.gentoo.org/glsa/glsa-201412-42.xml
- http://support.citrix.com/article/CTX200218
- http://www.debian.org/security/2014/dsa-3041
- http://www.securityfocus.com/bid/70057
- http://www.securitytracker.com/id/1030888
- http://xenbits.xen.org/xsa/advisory-105.html
- http://lists.fedoraproject.org/pipermail/package-announce/2014-October/140418.html
- http://lists.fedoraproject.org/pipermail/package-announce/2014-October/140483.html
- http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00002.html
- http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00003.html
- http://secunia.com/advisories/61858
- http://secunia.com/advisories/61890
- http://security.gentoo.org/glsa/glsa-201412-42.xml
- http://support.citrix.com/article/CTX200218
- http://www.debian.org/security/2014/dsa-3041
- http://www.securityfocus.com/bid/70057
- http://www.securitytracker.com/id/1030888
- http://xenbits.xen.org/xsa/advisory-105.html
LOW1.9
arch/x86/x86_emulate/x86_emulate.c in Xen 3.2.1 through 4.4.x does not properly check privileges, which allows local HVM guest users to gain privileges or cause a denial of service (crash) via a crafted (1) CALL, (2) JMP, (3) RETF, (4) LCALL, (5) LJMP, or (6) LRET far branch instruction.
CVSS 2.0НИЗКАЯ 1.9
CVSS:2.0/AV:L/AC:M/Au:N/C:N/I:N/A:PСсылки
- http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00005.html
- http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00010.html
- http://secunia.com/advisories/62537
- http://secunia.com/advisories/62672
- http://support.citrix.com/article/CTX200288
- http://support.citrix.com/article/CTX201794
- http://www.debian.org/security/2015/dsa-3140
- http://www.securityfocus.com/bid/71151
- http://xenbits.xen.org/xsa/advisory-110.html
- https://exchange.xforce.ibmcloud.com/vulnerabilities/98768
- https://security.gentoo.org/glsa/201504-04
- http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00005.html
- http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00010.html
- http://secunia.com/advisories/62537
- http://secunia.com/advisories/62672
- http://support.citrix.com/article/CTX200288
- http://support.citrix.com/article/CTX201794
- http://www.debian.org/security/2015/dsa-3140
- http://www.securityfocus.com/bid/71151
- http://xenbits.xen.org/xsa/advisory-110.html
- https://exchange.xforce.ibmcloud.com/vulnerabilities/98768
- https://security.gentoo.org/glsa/201504-04
MEDIUM4.7
The compatibility mode hypercall argument translation in Xen 3.3.x through 4.4.x, when running on a 64-bit hypervisor, allows local 32-bit HVM guests to cause a denial of service (host crash) via vectors involving altering the high halves of registers while in 64-bit mode.
CVSS 2.0СРЕДНЯЯ 4.7
CVSS:2.0/AV:L/AC:M/Au:N/C:N/I:N/A:CСсылки
- http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00005.html
- http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00010.html
- http://secunia.com/advisories/59937
- http://secunia.com/advisories/62672
- http://support.citrix.com/article/CTX200288
- http://support.citrix.com/article/CTX201794
- http://www.debian.org/security/2015/dsa-3140
- http://www.securityfocus.com/bid/71332
- http://xenbits.xen.org/xsa/advisory-111.html
- https://security.gentoo.org/glsa/201504-04
- http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00005.html
- http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00010.html
- http://secunia.com/advisories/59937
- http://secunia.com/advisories/62672
- http://support.citrix.com/article/CTX200288
- http://support.citrix.com/article/CTX201794
- http://www.debian.org/security/2015/dsa-3140
- http://www.securityfocus.com/bid/71332
- http://xenbits.xen.org/xsa/advisory-111.html
- https://security.gentoo.org/glsa/201504-04
LOW2.1
The xenmem_add_to_physmap_one function in arch/arm/mm.c in Xen 4.5.x, 4.4.x, and earlier does not limit the number of printk console messages when reporting a failure to retrieve a reference on a foreign page, which allows remote domains to cause a denial of service by leveraging permissions to map the memory of a foreign guest.
CVSS 2.0НИЗКАЯ 2.1
CVSS:2.0/AV:L/AC:L/Au:N/C:N/I:N/A:PLOW3.8
The xrstor function in arch/x86/xstate.c in Xen 4.x does not properly handle writes to the hardware FSW.ES bit when running on AMD64 processors, which allows local guest OS users to obtain sensitive register content information from another guest by leveraging pending exception and mask bits. NOTE: this vulnerability exists because of an incorrect fix for CVE-2013-2076.
CVSS 2.0НИЗКАЯ 1.7
CVSS:2.0/AV:L/AC:L/Au:S/C:P/I:N/A:NCVSS 3.xНИЗКАЯ 3.8
CVSS:3.x/CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:NСсылки
- http://lists.fedoraproject.org/pipermail/package-announce/2016-April/181699.html
- http://lists.fedoraproject.org/pipermail/package-announce/2016-April/181729.html
- http://support.citrix.com/article/CTX209443
- http://www.debian.org/security/2016/dsa-3554
- http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html
- http://www.securityfocus.com/bid/85714
- http://www.securitytracker.com/id/1035435
- http://xenbits.xen.org/xsa/advisory-172.html
- http://xenbits.xen.org/xsa/xsa172-4.3.patch
- http://xenbits.xen.org/xsa/xsa172.patch
- http://lists.fedoraproject.org/pipermail/package-announce/2016-April/181699.html
- http://lists.fedoraproject.org/pipermail/package-announce/2016-April/181729.html
- http://support.citrix.com/article/CTX209443
- http://www.debian.org/security/2016/dsa-3554
- http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html
- http://www.securityfocus.com/bid/85714
- http://www.securitytracker.com/id/1035435
- http://xenbits.xen.org/xsa/advisory-172.html
- http://xenbits.xen.org/xsa/xsa172-4.3.patch
- http://xenbits.xen.org/xsa/xsa172.patch