Debian Xen vulnerabilities

CVE-2022-23033 [HIGH] CVE-2022-23033: xen - arm: guest_physmap_remove_page not removing the p2m mappings The functions to re... arm: guest_physmap_remove_page not removing the p2m mappings The functions to remove one or more entries from a guest p2m pagetable on Arm (p2m_remove_mapping, guest_physmap_remove_page, and p2m_set_entry with mfn set to INVALID_MFN) do not actually clear the pagetable entry if the entry doesn't have the valid bit set. It is possible to have a valid pagetable entry with

CVE-2020-15567 [HIGH] CVE-2020-15567: xen - An issue was discovered in Xen through 4.13.x, allowing Intel guest OS users to ... An issue was discovered in Xen through 4.13.x, allowing Intel guest OS users to gain privileges or cause a denial of service because of non-atomic modification of a live EPT PTE. When mapping guest EPT (nested paging) tables, Xen would in some circumstances use a series of non-atomic bitfield writes. Depending on the compiler version and optimisation flags, Xen might ex

CVE-2022-42332 [HIGH] CVE-2022-42332: xen - x86 shadow plus log-dirty mode use-after-free In environments where host assiste... x86 shadow plus log-dirty mode use-after-free In environments where host assisted address translation is necessary but Hardware Assisted Paging (HAP) is unavailable, Xen will run guests in so called shadow mode. Shadow mode maintains a pool of memory used for both shadow page tables as well as auxiliary data structures. To migrate or snapshot guests, Xen additionally ru

CVE-2023-34322 [HIGH] CVE-2023-34322: xen - For migration as well as to work around kernels unaware of L1TF (see XSA-273), P... For migration as well as to work around kernels unaware of L1TF (see XSA-273), PV guests may be run in shadow paging mode. Since Xen itself needs to be mapped when PV guests run, Xen and shadowed PV guests run directly the respective shadow page tables. For 64-bit PV guests this means running on the shadow of the guest root page table. In the course of dealing with shor

CVE-2025-1713 [HIGH] CVE-2025-1713: xen - When setting up interrupt remapping for legacy PCI(-X) devices, including PCI(-X... When setting up interrupt remapping for legacy PCI(-X) devices, including PCI(-X) bridges, a lookup of the upstream bridge is required. This lookup, itself involving acquiring of a lock, is done in a context where acquiring that lock is unsafe. This can lead to a deadlock. Scope: local bookworm: resolved (fixed in 4.17.5+72-g01140da4e8-1) bullseye: open forky: resolved (f

CVE-2025-58144 [HIGH] CVE-2025-58144: xen - [This CNA information record relates to multiple CVEs; the text explains which a... [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] There are two issues related to the mapping of pages belonging to other domains: For one, an assertion is wrong there, where the case actually needs handling. A NULL pointer de-reference could result on a release build. This is CVE-2025-58144.

CVE-2025-58145 [HIGH] CVE-2025-58145: xen - [This CNA information record relates to multiple CVEs; the text explains which a... [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] There are two issues related to the mapping of pages belonging to other domains: For one, an assertion is wrong there, where the case actually needs handling. A NULL pointer de-reference could result on a release build. This is CVE-2025-58144.

CVE-2024-45817 [HIGH] CVE-2024-45817: xen - In x86's APIC (Advanced Programmable Interrupt Controller) architecture, error c... In x86's APIC (Advanced Programmable Interrupt Controller) architecture, error conditions are reported in a status register. Furthermore, the OS can opt to receive an interrupt when a new error occurs. It is possible to configure the error interrupt with an illegal vector, which generates an error when an error interrupt is raised. This case causes Xen to recurse throug

CVE-2016-9383 [HIGH] CVE-2016-9383: xen - Xen, when running on a 64-bit hypervisor, allows local x86 guest OS users to mod... Xen, when running on a 64-bit hypervisor, allows local x86 guest OS users to modify arbitrary memory and consequently obtain sensitive information, cause a denial of service (host crash), or execute arbitrary code on the host by leveraging broken emulation of bit test instructions. Scope: local bookworm: resolved (fixed in 4.8.0-1) bullseye: resolved (fixed in 4.8.0-1) fo

CVE-2018-10982 [HIGH] CVE-2018-10982: xen - An issue was discovered in Xen through 4.10.x allowing x86 HVM guest OS users to... An issue was discovered in Xen through 4.10.x allowing x86 HVM guest OS users to cause a denial of service (unexpectedly high interrupt number, array overrun, and hypervisor crash) or possibly gain hypervisor privileges by setting up an HPET timer to deliver interrupts in IO-APIC mode, aka vHPET interrupt injection. Scope: local bookworm: resolved (fixed in 4.8.3+xsa262

CVE-2017-14319 [HIGH] CVE-2017-14319: xen - A grant unmapping issue was discovered in Xen through 4.9.x. When removing or re... A grant unmapping issue was discovered in Xen through 4.9.x. When removing or replacing a grant mapping, the x86 PV specific path needs to make sure page table entries remain in sync with other accounting done. Although the identity of the page frame was validated correctly, neither the presence of the mapping nor page writability were taken into account. Scope: local b

CVE-2021-27379 [HIGH] CVE-2021-27379: xen - An issue was discovered in Xen through 4.11.x, allowing x86 Intel HVM guest OS u... An issue was discovered in Xen through 4.11.x, allowing x86 Intel HVM guest OS users to achieve unintended read/write DMA access, and possibly cause a denial of service (host OS crash) or gain privileges. This occurs because a backport missed a flush, and thus IOMMU updates were not always correct. NOTE: this issue exists because of an incomplete fix for CVE-2020-15565.

CVE-2015-8550 [HIGH] CVE-2015-8550: linux - Xen, when used on a system providing PV backends, allows local guest OS administ... Xen, when used on a system providing PV backends, allows local guest OS administrators to cause a denial of service (host OS crash) or gain privileges by writing to memory shared between the frontend and backend, aka a double fetch vulnerability. Scope: local bookworm: resolved (fixed in 4.3.3-3) bullseye: resolved (fixed in 4.3.3-3) forky: resolved (fixed in 4.3.3-3) s

CVE-2022-42330 [HIGH] CVE-2022-42330: xen - Guests can cause Xenstore crash via soft reset When a guest issues a "Soft Reset... Guests can cause Xenstore crash via soft reset When a guest issues a "Soft Reset" (e.g. for performing a kexec) the libxl based Xen toolstack will normally perform a XS_RELEASE Xenstore operation. Due to a bug in xenstored this can result in a crash of xenstored. Any other use of XS_RELEASE will have the same impact. Scope: local bookworm: resolved (fixed in 4.17.0+24-g

CVE-2016-9382 [HIGH] CVE-2016-9382: xen - Xen 4.0.x through 4.7.x mishandle x86 task switches to VM86 mode, which allows l... Xen 4.0.x through 4.7.x mishandle x86 task switches to VM86 mode, which allows local 32-bit x86 HVM guest OS users to gain privileges or cause a denial of service (guest OS crash) by leveraging a guest operating system that uses hardware task switching and allows a new task to start in VM86 mode. Scope: local bookworm: resolved (fixed in 4.8.0-1) bullseye: resolved (fixed

CVE-2016-9386 [HIGH] CVE-2016-9386: xen - The x86 emulator in Xen does not properly treat x86 NULL segments as unusable wh... The x86 emulator in Xen does not properly treat x86 NULL segments as unusable when accessing memory, which might allow local HVM guest users to gain privileges via vectors involving "unexpected" base/limit values. Scope: local bookworm: resolved (fixed in 4.8.0-1) bullseye: resolved (fixed in 4.8.0-1) forky: resolved (fixed in 4.8.0-1) sid: resolved (fixed in 4.8.0-1) tri

CVE-2020-25603 [HIGH] CVE-2020-25603: xen - An issue was discovered in Xen through 4.14.x. There are missing memory barriers... An issue was discovered in Xen through 4.14.x. There are missing memory barriers when accessing/allocating an event channel. Event channels control structures can be accessed lockless as long as the port is considered to be valid. Such a sequence is missing an appropriate memory barrier (e.g., smp_*mb()) to prevent both the compiler and CPU from re-ordering access. A ma

CVE-2018-19962 [HIGH] CVE-2018-19962: xen - An issue was discovered in Xen through 4.11.x on AMD x86 platforms, possibly all... An issue was discovered in Xen through 4.11.x on AMD x86 platforms, possibly allowing guest OS users to gain host OS privileges because small IOMMU mappings are unsafely combined into larger ones. Scope: local bookworm: resolved (fixed in 4.11.1-1) bullseye: resolved (fixed in 4.11.1-1) forky: resolved (fixed in 4.11.1-1) sid: resolved (fixed in 4.11.1-1) trixie: resolv

CVE-2018-19961 [HIGH] CVE-2018-19961: xen - An issue was discovered in Xen through 4.11.x on AMD x86 platforms, possibly all... An issue was discovered in Xen through 4.11.x on AMD x86 platforms, possibly allowing guest OS users to gain host OS privileges because TLB flushes do not always occur after IOMMU mapping changes. Scope: local bookworm: resolved (fixed in 4.11.1-1) bullseye: resolved (fixed in 4.11.1-1) forky: resolved (fixed in 4.11.1-1) sid: resolved (fixed in 4.11.1-1) trixie: resolv

CVE-2017-17563 [HIGH] CVE-2017-17563: xen - An issue was discovered in Xen through 4.9.x allowing guest OS users to cause a ... An issue was discovered in Xen through 4.9.x allowing guest OS users to cause a denial of service (host OS crash) or gain host OS privileges by leveraging an incorrect mask for reference-count overflow checking in shadow mode. Scope: local bookworm: resolved (fixed in 4.8.3+comet2+shim4.10.0+comet3-1+deb9u5) bullseye: resolved (fixed in 4.8.3+comet2+shim4.10.0+comet3-1+