Debian Xen vulnerabilities

CVE-2022-33748 [MEDIUM] CVE-2022-33748: xen - lock order inversion in transitive grant copy handling As part of XSA-226 a miss... lock order inversion in transitive grant copy handling As part of XSA-226 a missing cleanup call was inserted on an error handling path. While doing so, locking requirements were not paid attention to. As a result two cooperating guests granting each other transitive grants can cause locks to be acquired nested within one another, but in respectively opposite order. W

CVE-2022-26356 [MEDIUM] CVE-2022-26356: xen - Racy interactions between dirty vram tracking and paging log dirty hypercalls Ac... Racy interactions between dirty vram tracking and paging log dirty hypercalls Activation of log dirty mode done by XEN_DMOP_track_dirty_vram (was named HVMOP_track_dirty_vram before Xen 4.9) is racy with ongoing log dirty hypercalls. A suitably timed call to XEN_DMOP_track_dirty_vram can enable log dirty while another CPU is still in the process of tearing down the st

CVE-2022-23034 [MEDIUM] CVE-2022-23034: xen - A PV guest could DoS Xen while unmapping a grant To address XSA-380, reference c... A PV guest could DoS Xen while unmapping a grant To address XSA-380, reference counting was introduced for grant mappings for the case where a PV guest would have the IOMMU enabled. PV guests can request two forms of mappings. When both are in use for any individual mapping, unmapping of such a mapping can be requested in two steps. The reference count for such a mapp

CVE-2022-42324 [MEDIUM] CVE-2022-42324: xen - Oxenstored 32->31 bit integer truncation issues Integers in Ocaml are 63 or 31 b... Oxenstored 32->31 bit integer truncation issues Integers in Ocaml are 63 or 31 bits of signed precision. The Ocaml Xenbus library takes a C uint32_t out of the ring and casts it directly to an Ocaml integer. In 64-bit Ocaml builds this is fine, but in 32-bit builds, it truncates off the most significant bit, and then creates unsigned/signed confusion in the remainder.

CVE-2014-1896 [MEDIUM] CVE-2014-1896: xen - The (1) do_send and (2) do_recv functions in io.c in libvchan in Xen 4.2.x, 4.3.... The (1) do_send and (2) do_recv functions in io.c in libvchan in Xen 4.2.x, 4.3.x, and 4.4-RC series allows local guests to cause a denial of service or possibly gain privileges via crafted xenstore ring indexes, which triggers a "read or write past the end of the ring." Scope: local bookworm: resolved (fixed in 4.4.0-1) bullseye: resolved (fixed in 4.4.0-1) forky: reso

CVE-2022-27672 [MEDIUM] CVE-2022-27672: linux - When SMT is enabled, certain AMD processors may speculatively execute instructio... When SMT is enabled, certain AMD processors may speculatively execute instructions using a target from the sibling thread after an SMT mode switch potentially resulting in information disclosure. Scope: local bookworm: resolved (fixed in 6.1.12-1) bullseye: open forky: resolved (fixed in 6.1.12-1) sid: resolved (fixed in 6.1.12-1) trixie: resolved (fixed in 6.1.12-1

CVE-2013-2196 [MEDIUM] CVE-2013-2196: xen - Multiple unspecified vulnerabilities in the Elf parser (libelf) in Xen 4.2.x and... Multiple unspecified vulnerabilities in the Elf parser (libelf) in Xen 4.2.x and earlier allow local guest administrators with certain permissions to have an unspecified impact via a crafted kernel, related to "other problems" that are not CVE-2013-2194 or CVE-2013-2195. Scope: local bookworm: resolved (fixed in 4.3.0-1) bullseye: resolved (fixed in 4.3.0-1) forky: reso

CVE-2014-1642 [MEDIUM] CVE-2014-1642: xen - The IRQ setup in Xen 4.2.x and 4.3.x, when using device passthrough and configur... The IRQ setup in Xen 4.2.x and 4.3.x, when using device passthrough and configured to support a large number of CPUs, frees certain memory that may still be intended for use, which allows local guest administrators to cause a denial of service (memory corruption and hypervisor crash) and possibly execute arbitrary code via vectors related to an out-of-memory error that

CVE-2016-9818 [MEDIUM] CVE-2016-9818: xen - Xen through 4.7.x allows local ARM guest OS users to cause a denial of service (... Xen through 4.7.x allows local ARM guest OS users to cause a denial of service (host crash) via vectors involving an asynchronous abort while at HYP. Scope: local bookworm: resolved (fixed in 4.8.0-1) bullseye: resolved (fixed in 4.8.0-1) forky: resolved (fixed in 4.8.0-1) sid: resolved (fixed in 4.8.0-1) trixie: resolved (fixed in 4.8.0-1)

CVE-2016-9816 [MEDIUM] CVE-2016-9816: xen - Xen through 4.7.x allows local ARM guest OS users to cause a denial of service (... Xen through 4.7.x allows local ARM guest OS users to cause a denial of service (host crash) via vectors involving an asynchronous abort while at EL2. Scope: local bookworm: resolved (fixed in 4.8.0-1) bullseye: resolved (fixed in 4.8.0-1) forky: resolved (fixed in 4.8.0-1) sid: resolved (fixed in 4.8.0-1) trixie: resolved (fixed in 4.8.0-1)

CVE-2016-6259 [MEDIUM] CVE-2016-6259: xen - Xen 4.5.x through 4.7.x do not implement Supervisor Mode Access Prevention (SMAP... Xen 4.5.x through 4.7.x do not implement Supervisor Mode Access Prevention (SMAP) whitelisting in 32-bit exception and event delivery, which allows local 32-bit PV guest OS kernels to cause a denial of service (hypervisor and VM crash) by triggering a safety check. Scope: local bookworm: resolved (fixed in 4.8.0~rc3-1) bullseye: resolved (fixed in 4.8.0~rc3-1) forky: re

CVE-2010-4255 [MEDIUM] CVE-2010-4255: xen - The fixup_page_fault function in arch/x86/traps.c in Xen 4.0.1 and earlier on 64... The fixup_page_fault function in arch/x86/traps.c in Xen 4.0.1 and earlier on 64-bit platforms, when paravirtualization is enabled, does not verify that kernel mode is used to call the handle_gdt_ldt_mapping_fault function, which allows guest OS users to cause a denial of service (host OS BUG_ON) via a crafted memory access. Scope: local bookworm: resolved (fixed in 4.0

CVE-2012-5634 [MEDIUM] CVE-2012-5634: xen - Xen 4.2.x, 4.1.x, and 4.0, when using Intel VT-d for PCI passthrough, does not p... Xen 4.2.x, 4.1.x, and 4.0, when using Intel VT-d for PCI passthrough, does not properly configure VT-d when supporting a device that is behind a legacy PCI Bridge, which allows local guests to cause a denial of service to other guests by injecting an interrupt. Scope: local bookworm: resolved (fixed in 4.1.3-8) bullseye: resolved (fixed in 4.1.3-8) forky: resolved (fixe

CVE-2012-3495 [MEDIUM] CVE-2012-3495: xen - The physdev_get_free_pirq hypercall in arch/x86/physdev.c in Xen 4.1.x and Citri... The physdev_get_free_pirq hypercall in arch/x86/physdev.c in Xen 4.1.x and Citrix XenServer 6.0.2 and earlier uses the return value of the get_free_pirq function as an array index without checking that the return value indicates an error, which allows guest OS users to cause a denial of service (invalid memory write and host crash) and possibly gain privileges via unspe

CVE-2016-9385 [MEDIUM] CVE-2016-9385: xen - The x86 segment base write emulation functionality in Xen 4.4.x through 4.7.x al... The x86 segment base write emulation functionality in Xen 4.4.x through 4.7.x allows local x86 PV guest OS administrators to cause a denial of service (host crash) by leveraging lack of canonical address checks. Scope: local bookworm: resolved (fixed in 4.8.0-1) bullseye: resolved (fixed in 4.8.0-1) forky: resolved (fixed in 4.8.0-1) sid: resolved (fixed in 4.8.0-1) tri

CVE-2016-10024 [MEDIUM] CVE-2016-10024: xen - Xen through 4.8.x allows local x86 PV guest OS kernel administrators to cause a ... Xen through 4.8.x allows local x86 PV guest OS kernel administrators to cause a denial of service (host hang or crash) by modifying the instruction stream asynchronously while performing certain kernel operations. Scope: local bookworm: resolved (fixed in 4.8.0-1) bullseye: resolved (fixed in 4.8.0-1) forky: resolved (fixed in 4.8.0-1) sid: resolved (fixed in 4.8.0-1)

CVE-2020-29484 [MEDIUM] CVE-2020-29484: xen - An issue was discovered in Xen through 4.14.x. When a Xenstore watch fires, the ... An issue was discovered in Xen through 4.14.x. When a Xenstore watch fires, the xenstore client that registered the watch will receive a Xenstore message containing the path of the modified Xenstore entry that triggered the watch, and the tag that was specified when registering the watch. Any communication with xenstored is done via Xenstore messages, consisting of a

CVE-2013-2212 [MEDIUM] CVE-2013-2212: xen - The vmx_set_uc_mode function in Xen 3.3 through 4.3, when disabling caches, allo... The vmx_set_uc_mode function in Xen 3.3 through 4.3, when disabling caches, allows local HVM guests with access to memory mapped I/O regions to cause a denial of service (CPU consumption and possibly hypervisor or guest kernel panic) via a crafted GFN range. Scope: local bookworm: resolved (fixed in 4.3.0-1) bullseye: resolved (fixed in 4.3.0-1) forky: resolved (fixed i

CVE-2017-14317 [MEDIUM] CVE-2017-14317: xen - A domain cleanup issue was discovered in the C xenstore daemon (aka cxenstored) ... A domain cleanup issue was discovered in the C xenstore daemon (aka cxenstored) in Xen through 4.9.x. When shutting down a VM with a stubdomain, a race in cxenstored may cause a double-free. The xenstored daemon may crash, resulting in a DoS of any parts of the system relying on it (including domain creation / destruction, ballooning, device changes, etc.). Scope: loc

CVE-2021-28698 [MEDIUM] CVE-2021-28698: xen - long running loops in grant table handling In order to properly monitor resource... long running loops in grant table handling In order to properly monitor resource use, Xen maintains information on the grant mappings a domain may create to map grants offered by other domains. In the process of carrying out certain actions, Xen would iterate over all such entries, including ones which aren't in use anymore and some which may have been created but nev