Where
AND
-Infinity
0
Severity
8.8
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

The PV pagetable code in arch/x86/mm.c in Xen 4.7.x and earlier allows local 32-bit PV guest OS administrators to gain host OS privileges by leveraging fast-paths for updating pagetable entries.

First published (updated )
Severity
8.5
Input Validation
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

The PV superpage functionality in arch/x86/mm.c in Xen 3.4.0, 3.4.1, and 4.1.x through 4.6.x allows local PV guests to obtain sensitive information, cause a denial of service, gain privileges, or have unspecified other impact via a crafted page identifier (MFN) to the (1) MMUEXTMARKSUPER or (2) MMUEXTUNMARKSUPER sub-op in the HYPERVISORmmuextop hypercall or (3) unknown vectors related to page table updates.

First published (updated )
Severity
8.3
AV:A/AC:L/Au:N/C:C/I:C/A:C

The hvmmsrreadintercept function in arch/x86/hvm/hvm.c in Xen 4.1 through 4.4.x uses an improper MSR range for x2APIC emulation, which allows local HVM guests to cause a denial of service (host crash) or read data from the hypervisor or other guests via unspecified vectors.

First published (updated )
Severity
7.8
Use After Free
AV:N/AC:L/Au:N/C:N/I:N/A:C

Use-after-free vulnerability in Xen 4.2.x, 4.3.x, and 4.4.x allows remote domains to cause a denial of service (system crash) via a crafted hypercall during HVM guest teardown.

First published (updated )
Severity
7.8
AV:N/AC:L/Au:N/C:N/I:N/A:C

Xen 3.3.x through 4.5.x does not properly restrict access to PCI MSI mask bits, which allows local x86 HVM guest users to cause a denial of service (unexpected interrupt and host crash) via unspecified vectors.

First published (updated )
Severity
7.8
AV:N/AC:L/Au:N/C:N/I:N/A:C

The libxl toolstack library in Xen 4.1.x through 4.6.x does not properly release mappings of files used as kernels and initial ramdisks when managing multiple domains in the same process, which allows attackers to cause a denial of service (memory and disk consumption) by starting domains.

First published (updated )
Severity
7.4
Buffer Overflow
AV:A/AC:M/Au:S/C:C/I:C/A:C

Buffer overflow in the Python bindings for the xcvcpusetaffinity call in Xen 4.0.x, 4.1.x, and 4.2.x allows local administrators with permissions to configure VCPU affinity to cause a denial of service (memory corruption and xend toolstack crash) and possibly gain privileges via a crafted cpumap.

First published (updated )
Severity
7.4
AV:A/AC:M/Au:S/C:C/I:C/A:C

The libxenlight (libxl) toolstack library in Xen 4.0.x, 4.1.x, and 4.2.x uses weak permissions for xenstore keys for paravirtualised and emulated serial console devices, which allows local guest administrators to modify the xenstore value via unspecified vectors.

First published (updated )
Severity
7.2
AV:L/AC:L/Au:N/C:C/I:C/A:C

The x86 emulator in Xen 3.2.x through 4.5.x does not properly ignore segment overrides for instructions with register operands, which allows local guest users to obtain sensitive information, cause a denial of service (memory corruption), or possibly execute arbitrary code via unspecified vectors.

First published (updated )
Severity
7.2
Input Validation
AV:L/AC:L/Au:N/C:C/I:C/A:C

The modl2entry function in arch/x86/mm.c in Xen 3.4 through 4.6.x does not properly validate level 2 page table entries, which allows local PV guest administrators to gain privileges via a crafted superpage mapping.

First published (updated )
Severity
7.1
Input Validation
AV:N/AC:M/Au:N/C:N/I:N/A:C

The dommuupdate function in arch/x86/mm.c in Xen 3.2.x through 4.4.x does not properly manage page references, which allows remote domains to cause a denial of service by leveraging control over an HVM guest and a crafted MMUMACHPHYSUPDATE.

First published (updated )
Severity
6.9
AV:L/AC:M/Au:N/C:C/I:C/A:C

The Elf parser (libelf) in Xen 4.2.x and earlier allow local guest administrators with certain permissions to have an unspecified impact via a crafted kernel, related to "pointer dereferences" involving unexpected calculations.

First published (updated )
Severity
6.9
Integer Overflow
AV:L/AC:M/Au:N/C:C/I:C/A:C

Multiple integer overflows in the Elf parser (libelf) in Xen 4.2.x and earlier allow local guest administrators with certain permissions to have an unspecified impact via a crafted kernel.

First published (updated )
Severity
6.9
AV:L/AC:M/Au:N/C:C/I:C/A:C

Multiple unspecified vulnerabilities in the Elf parser (libelf) in Xen 4.2.x and earlier allow local guest administrators with certain permissions to have an unspecified impact via a crafted kernel, related to "other problems" that are not CVE-2013-2194 or CVE-2013-2195.

First published (updated )
Severity
6.8
Buffer Overflow
AV:L/AC:L/Au:S/C:C/I:C/A:C

Stack-based buffer overflow in the xl command line utility in Xen 4.1.x through 4.5.x allows local guest administrators to gain privileges via a long configuration argument.

First published (updated )
Severity
6.5
AV:A/AC:H/Au:S/C:C/I:C/A:C

The xenlight library (libxl) in Xen 4.0.x through 4.2.x, when IOMMU is disabled, provides access to a busmastering-capable PCI passthrough device before the IOMMU setup is complete, which allows local HVM guest domains to gain privileges or cause a denial of service via a DMA instruction.

First published (updated )
Severity
6.3
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H

The paginginvlpg function in include/asm-x86/paging.h in Xen 3.3.x through 4.6.x, when using shadow mode paging or nested virtualization is enabled, allows local HVM guest users to cause a denial of service (host crash) via a non-canonical guest address in an INVVPID instruction, which triggers a hypervisor bug check.

First published (updated )
Severity
6.1
Race Condition
AV:A/AC:L/Au:N/C:N/I:N/A:C

Race condition in HVMOPtrackdirtyvram in Xen 4.0.0 through 4.4.x does not ensure possession of the guarding lock for dirty video RAM tracking, which allows certain local guest domains to cause a denial of service via unspecified vectors.

First published (updated )
Severity
5.8
AV:A/AC:L/Au:N/C:P/I:P/A:P

The x86emulate function in arch/x86/x86emulate/x86emulate.c in Xen 4.4.x and earlier does not properly check supervisor mode permissions, which allows local HVM users to cause a denial of service (guest crash) or gain guest kernel mode privileges via vectors involving an (1) HLT, (2) LGDT, (3) LIDT, or (4) LMSW instruction.

First published (updated )
Severity
5.7
Buffer Overflow
AV:A/AC:M/Au:N/C:N/I:N/A:C

The vmxsetucmode function in Xen 3.3 through 4.3, when disabling caches, allows local HVM guests with access to memory mapped I/O regions to cause a denial of service (CPU consumption and possibly hypervisor or guest kernel panic) via a crafted GFN range.

First published (updated )
Severity
5.7
Input Validation
AV:A/AC:M/Au:N/C:N/I:N/A:C

Xen 4.2.x and 4.3.x, when nested virtualization is disabled, does not properly check the emulation paths for (1) VMLAUNCH and (2) VMRESUME, which allows local HVM guest users to cause a denial of service (host crash) via unspecified vectors related to "guest VMX instruction execution."

First published (updated )
Severity
5.5
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Memory leak in Xen 3.3 through 4.8.x allows guest OS users to cause a denial of service (ARM or x86 AMD host OS memory consumption) by continually rebooting, because certain cleanup is skipped if no pass-through device was ever assigned, aka XSA-207.

First published (updated )
Severity
5.4
Input Validation, Null Pointer Dereference
AV:N/AC:H/Au:N/C:N/I:N/A:C

The dommuupdate function in arch/x86/mm.c in Xen 4.x through 4.4.x does not properly restrict updates to only PV page tables, which allows remote PV guests to cause a denial of service (NULL pointer dereference) by leveraging hardware emulation services for HVM guests using Hardware Assisted Paging (HAP).

First published (updated )
Severity
5.2
AV:A/AC:M/Au:S/C:N/I:N/A:C

Xen 4.0.x, 4.1.x, and 4.2.x does not properly restrict the contents of a XRSTOR, which allows local PV guest users to cause a denial of service (unhandled exception and hypervisor crash) via unspecified vectors.

First published (updated )
Severity
5.2
Buffer Overflow
AV:A/AC:M/Au:S/C:N/I:N/A:C

The Ocaml xenstored implementation (oxenstored) in Xen 4.1.x, 4.2.x, and 4.3.x allows local guest domains to cause a denial of service (domain shutdown) via a large message reply.

First published (updated )
Severity
5.2
Buffer Overflow
AV:A/AC:M/Au:S/C:N/I:N/A:C

The XENDOMCTLgetmemlist hypercall in Xen 3.4.x through 4.3.x (possibly 4.3.1) does not always obtain the pagealloclock and mmrwlock in the same order, which allows local guest administrators to cause a denial of service (host deadlock).

First published (updated )
Severity
5.2
AV:A/AC:L/Au:S/C:P/I:P/A:P

Xen 3.0.3 through 4.1.x (possibly 4.1.6.1), 4.2.x (possibly 4.2.3), and 4.3.x (possibly 4.3.1) does not properly prevent access to hypercalls, which allows local guest users to gain privileges via a crafted application running in ring 1 or 2.

First published (updated )
Severity
4.9
Null Pointer Dereference
AV:L/AC:L/Au:N/C:N/I:N/A:C

GNTTABOPswapgrantref in Xen 4.2 through 4.5 does not check the grant table operation version, which allows local guest domains to cause a denial of service (NULL pointer dereference) via a hypercall without a GNTTABOPsetuptable or GNTTABOPsetversion.

First published (updated )
Severity
4.9
AV:L/AC:L/Au:N/C:N/I:N/A:C

Xen 3.3.x through 4.5.x enables logging for PCI MSI-X pass-through error messages, which allows local x86 HVM guests to cause a denial of service (host disk consumption) via certain invalid operations.

First published (updated )
Severity
4.9
AV:L/AC:L/Au:N/C:N/I:N/A:C

The compatiret function in Xen 3.1 through 4.5 iterates the wrong way through a loop, which allows local 32-bit PV guest administrators to cause a denial of service (large loop and system hang) via a hypercalliret call with EFLAGS.VM set.

First published (updated )

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203