CVE-2016-4963: Medium severity xen xapi vulnerability

Published Jun 7, 2016

Updated

The libxl device-handling in Xen through 4.6.x allows local guest OS users with access to the driver domain to cause a denial of service (management tool confusion) by manipulating information in the backend directories in xenstore.

Affected Software

36 affected components

XEN Xen=4.0.0

XEN Xen=4.0.1

XEN Xen=4.0.2

XEN Xen=4.0.3

XEN Xen=4.0.4

XEN Xen=4.1.0

XEN Xen=4.1.1

XEN Xen=4.1.2

XEN Xen=4.1.3

XEN Xen=4.1.4

XEN Xen=4.1.5

XEN Xen=4.1.6

XEN Xen=4.1.6.1

XEN Xen=4.2.0

XEN Xen=4.2.1

XEN Xen=4.2.2

XEN Xen=4.2.3

XEN Xen=4.2.4

XEN Xen=4.2.5

XEN Xen=4.3.0

XEN Xen=4.3.1

XEN Xen=4.3.2

XEN Xen=4.3.3

XEN Xen=4.3.4

XEN Xen=4.4.0

XEN Xen=4.4.0-rc1

XEN Xen=4.4.1

XEN Xen=4.4.2

XEN Xen=4.4.3

XEN Xen=4.4.4

XEN Xen=4.5.0

XEN Xen=4.5.1

XEN Xen=4.5.2

XEN Xen=4.5.3

XEN Xen=4.6.0

XEN Xen=4.6.1

Event History

Jun 7, 2016

CVE Published

via MITRE·02:00 PM

Data Sourced

via MITRE·02:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2016-4963?

The severity of CVE-2016-4963 is considered moderate, as it allows denial of service specifically affecting management tool operation in vulnerable Xen versions.

How does CVE-2016-4963 affect my Xen environment?

CVE-2016-4963 allows local guest OS users to manipulate xenstore backend directories, potentially causing confusion in management tools and leading to a denial of service.

Which versions of Xen are affected by CVE-2016-4963?

CVE-2016-4963 affects Xen versions from 4.0.0 to 4.6.1, including all versions in between.

How do I fix CVE-2016-4963?

To fix CVE-2016-4963, update your Xen installation to a version beyond 4.6.1 where the vulnerability has been addressed.

What mitigations exist for CVE-2016-4963?

There are no specific mitigations other than upgrading to an unaffected version of Xen to resolve CVE-2016-4963.