Debian Xen vulnerabilities

CVE-2016-9378 [MEDIUM] CVE-2016-9378: xen - Xen 4.5.x through 4.7.x on AMD systems without the NRip feature, when emulating ... Xen 4.5.x through 4.7.x on AMD systems without the NRip feature, when emulating instructions that generate software interrupts, allows local HVM guest OS users to cause a denial of service (guest crash) by leveraging an incorrect choice for software interrupt delivery. Scope: local bookworm: resolved (fixed in 4.8.0-1) bullseye: resolved (fixed in 4.8.0-1) forky: resolv

CVE-2012-5511 [MEDIUM] CVE-2012-5511: xen - Stack-based buffer overflow in the dirty video RAM tracking functionality in Xen... Stack-based buffer overflow in the dirty video RAM tracking functionality in Xen 3.4 through 4.1 allows local HVM guest OS administrators to cause a denial of service (crash) via a large bitmap image. Scope: local bookworm: resolved (fixed in 4.1.3-5) bullseye: resolved (fixed in 4.1.3-5) forky: resolved (fixed in 4.1.3-5) sid: resolved (fixed in 4.1.3-5) trixie: resolv

CVE-2013-4370 [MEDIUM] CVE-2013-4370: xen - The ocaml binding for the xc_vcpu_getaffinity function in Xen 4.2.x and 4.3.x fr... The ocaml binding for the xc_vcpu_getaffinity function in Xen 4.2.x and 4.3.x frees certain memory that may still be intended for use, which allows local users to cause a denial of service (heap corruption and crash) and possibly execute arbitrary code via unspecified vectors that trigger a (1) use-after-free or (2) double free. Scope: local bookworm: resolved (fixed in

CVE-2013-2194 [MEDIUM] CVE-2013-2194: xen - Multiple integer overflows in the Elf parser (libelf) in Xen 4.2.x and earlier a... Multiple integer overflows in the Elf parser (libelf) in Xen 4.2.x and earlier allow local guest administrators with certain permissions to have an unspecified impact via a crafted kernel. Scope: local bookworm: resolved (fixed in 4.3.0-1) bullseye: resolved (fixed in 4.3.0-1) forky: resolved (fixed in 4.3.0-1) sid: resolved (fixed in 4.3.0-1) trixie: resolved (fixed in

CVE-2013-4371 [MEDIUM] CVE-2013-4371: xen - Use-after-free vulnerability in the libxl_list_cpupool function in the libxl too... Use-after-free vulnerability in the libxl_list_cpupool function in the libxl toolstack library in Xen 4.2.x and 4.3.x, when running "under memory pressure," returns the original pointer when the realloc function fails, which allows local users to cause a denial of service (heap corruption and crash) and possibly execute arbitrary code via unspecified vectors. Scope: loc

CVE-2020-28368 [MEDIUM] CVE-2020-28368: xen - Xen through 4.14.x allows guest OS administrators to obtain sensitive informatio... Xen through 4.14.x allows guest OS administrators to obtain sensitive information (such as AES keys from outside the guest) via a side-channel attack on a power/energy monitoring interface, aka a "Platypus" attack. NOTE: there is only one logically independent fix: to change the access control for each such interface in Xen. Scope: local bookworm: resolved (fixed in 4

CVE-2025-27465 [MEDIUM] CVE-2025-27465: xen - Certain instructions need intercepting and emulating by Xen. In some cases Xen ... Certain instructions need intercepting and emulating by Xen. In some cases Xen emulates the instruction by replaying it, using an executable stub. Some instructions may raise an exception, which is supposed to be handled gracefully. Certain replayed instructions have additional logic to set up and recover the changes to the arithmetic flags. For replayed instructions

CVE-2014-7154 [MEDIUM] CVE-2014-7154: xen - Race condition in HVMOP_track_dirty_vram in Xen 4.0.0 through 4.4.x does not ens... Race condition in HVMOP_track_dirty_vram in Xen 4.0.0 through 4.4.x does not ensure possession of the guarding lock for dirty video RAM tracking, which allows certain local guest domains to cause a denial of service via unspecified vectors. Scope: local bookworm: resolved (fixed in 4.4.1-3) bullseye: resolved (fixed in 4.4.1-3) forky: resolved (fixed in 4.4.1-3) sid: re

CVE-2018-15468 [MEDIUM] CVE-2018-15468: xen - An issue was discovered in Xen through 4.11.x. The DEBUGCTL MSR contains several... An issue was discovered in Xen through 4.11.x. The DEBUGCTL MSR contains several debugging features, some of which virtualise cleanly, but some do not. In particular, Branch Trace Store is not virtualised by the processor, and software has to be careful to configure it suitably not to lock up the core. As a result, it must only be available to fully trusted guests. Un

CVE-2013-4551 [MEDIUM] CVE-2013-4551: xen - Xen 4.2.x and 4.3.x, when nested virtualization is disabled, does not properly c... Xen 4.2.x and 4.3.x, when nested virtualization is disabled, does not properly check the emulation paths for (1) VMLAUNCH and (2) VMRESUME, which allows local HVM guest users to cause a denial of service (host crash) via unspecified vectors related to "guest VMX instruction execution." Scope: local bookworm: resolved (fixed in 4.4.0-1) bullseye: resolved (fixed in 4.4.0

CVE-2012-3498 [MEDIUM] CVE-2012-3498: xen - PHYSDEVOP_map_pirq in Xen 4.1 and 4.2 and Citrix XenServer 6.0.2 and earlier all... PHYSDEVOP_map_pirq in Xen 4.1 and 4.2 and Citrix XenServer 6.0.2 and earlier allows local HVM guest OS kernels to cause a denial of service (host crash) and possibly read hypervisor or guest memory via vectors related to a missing range check of map->index. Scope: local bookworm: resolved (fixed in 4.1.3-2) bullseye: resolved (fixed in 4.1.3-2) forky: resolved (fixed in

CVE-2017-17565 [MEDIUM] CVE-2017-17565: xen - An issue was discovered in Xen through 4.9.x allowing PV guest OS users to cause... An issue was discovered in Xen through 4.9.x allowing PV guest OS users to cause a denial of service (host OS crash) if shadow mode and log-dirty mode are in place, because of an incorrect assertion related to M2P. Scope: local bookworm: resolved (fixed in 4.8.3+comet2+shim4.10.0+comet3-1+deb9u5) bullseye: resolved (fixed in 4.8.3+comet2+shim4.10.0+comet3-1+deb9u5) fo

CVE-2016-5242 [MEDIUM] CVE-2016-5242: xen - The p2m_teardown function in arch/arm/p2m.c in Xen 4.4.x through 4.6.x allows lo... The p2m_teardown function in arch/arm/p2m.c in Xen 4.4.x through 4.6.x allows local guest OS users with access to the driver domain to cause a denial of service (NULL pointer dereference and host OS crash) by creating concurrent domains and holding references to them, related to VMID exhaustion. Scope: local bookworm: resolved (fixed in 4.8.0~rc3-1) bullseye: resolved (

CVE-2016-3712 [MEDIUM] CVE-2016-3712: qemu - Integer overflow in the VGA module in QEMU allows local guest OS users to cause ... Integer overflow in the VGA module in QEMU allows local guest OS users to cause a denial of service (out-of-bounds read and QEMU process crash) by editing VGA registers in VBE mode. Scope: local bookworm: resolved (fixed in 1:2.6+dfsg-1) bullseye: resolved (fixed in 1:2.6+dfsg-1) forky: resolved (fixed in 1:2.6+dfsg-1) sid: resolved (fixed in 1:2.6+dfsg-1) trixie: reso

CVE-2016-10025 [MEDIUM] CVE-2016-10025: xen - VMFUNC emulation in Xen 4.6.x through 4.8.x on x86 systems using AMD virtualizat... VMFUNC emulation in Xen 4.6.x through 4.8.x on x86 systems using AMD virtualization extensions (aka SVM) allows local HVM guest OS users to cause a denial of service (hypervisor crash) by leveraging a missing NULL pointer check. Scope: local bookworm: resolved (fixed in 4.8.0-1) bullseye: resolved (fixed in 4.8.0-1) forky: resolved (fixed in 4.8.0-1) sid: resolved (fi

CVE-2016-9377 [MEDIUM] CVE-2016-9377: xen - Xen 4.5.x through 4.7.x on AMD systems without the NRip feature, when emulating ... Xen 4.5.x through 4.7.x on AMD systems without the NRip feature, when emulating instructions that generate software interrupts, allows local HVM guest OS users to cause a denial of service (guest crash) by leveraging IDT entry miscalculation. Scope: local bookworm: resolved (fixed in 4.8.0-1) bullseye: resolved (fixed in 4.8.0-1) forky: resolved (fixed in 4.8.0-1) sid:

CVE-2017-14431 [MEDIUM] CVE-2017-14431: xen - Memory leak in Xen 3.3 through 4.8.x allows guest OS users to cause a denial of ... Memory leak in Xen 3.3 through 4.8.x allows guest OS users to cause a denial of service (ARM or x86 AMD host OS memory consumption) by continually rebooting, because certain cleanup is skipped if no pass-through device was ever assigned, aka XSA-207. Scope: local bookworm: resolved (fixed in 4.8.1-1) bullseye: resolved (fixed in 4.8.1-1) forky: resolved (fixed in 4.8.

CVE-2012-3497 [MEDIUM] CVE-2012-3497: xen - (1) TMEMC_SAVE_GET_CLIENT_WEIGHT, (2) TMEMC_SAVE_GET_CLIENT_CAP, (3) TMEMC_SAVE_... (1) TMEMC_SAVE_GET_CLIENT_WEIGHT, (2) TMEMC_SAVE_GET_CLIENT_CAP, (3) TMEMC_SAVE_GET_CLIENT_FLAGS and (4) TMEMC_SAVE_END in the Transcendent Memory (TMEM) in Xen 4.0, 4.1, and 4.2 allow local guest OS users to cause a denial of service (NULL pointer dereference or memory corruption and host crash) or possibly have other unspecified impacts via a NULL client id. Scope: lo

CVE-2013-2195 [MEDIUM] CVE-2013-2195: xen - The Elf parser (libelf) in Xen 4.2.x and earlier allow local guest administrator... The Elf parser (libelf) in Xen 4.2.x and earlier allow local guest administrators with certain permissions to have an unspecified impact via a crafted kernel, related to "pointer dereferences" involving unexpected calculations. Scope: local bookworm: resolved (fixed in 4.3.0-1) bullseye: resolved (fixed in 4.3.0-1) forky: resolved (fixed in 4.3.0-1) sid: resolved (fixed

CVE-2012-6033 [MEDIUM] CVE-2012-6033: xen - The do_tmem_control function in the Transcendent Memory (TMEM) in Xen 4.0, 4.1, ... The do_tmem_control function in the Transcendent Memory (TMEM) in Xen 4.0, 4.1, and 4.2 does not properly check privileges, which allows local guest OS users to access control stack operations via unspecified vectors. NOTE: this issue was originally published as part of CVE-2012-3497, which was too general; CVE-2012-3497 has been SPLIT into this ID and others. Scope: lo