Xen 3.2.x through 4.6.x does not limit the number of printk console messages when logging certain pmu and profiling hypercalls, which allows local guests to cause a denial of service via a sequence of crafted (1) HYPERCALL_xenoprof_op hypercalls, which are not properly handled in the do_xenoprof_op function in common/xenoprof.c, or (2) HYPERVISOR_xenpmu_op hypercalls, which are not properly handled in the do_xenpmu_op function in arch/x86/cpu/vpmu.c.
CVSS Details
- CVSS 3.1 Base Score: 5.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade xen | Sep 20, 2017 | Oct 30, 2015 |
| Debian | — | Upgrade xen | Dec 14, 2015 | Oct 30, 2015 |
| Freebsd | — | Upgrade xen-kernel | Dec 10, 2025 | Nov 11, 2015 |
| Gentoo Linux | — | Upgrade app-emulation/xen.Upgrade app-emulation/xen-pvgrub.Upgrade app-emulation/xen-tools.Upgrade app-emulation/pvgrub. | Oct 30, 2017 | Oct 30, 2015 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Oct 29, 2015 |
| Suse | — | Upgrade xen-doc-pdfUpgrade xen-libsUpgrade xen-libs-32bitUpgrade xen-kmp-paeUpgrade xen-kmp-defaultUpgrade xen-toolsUpgrade xen-tools-domUUpgrade xen-doc-htmlUpgrade xen-tools-xendomains-wait-diskUpgrade xen-develUpgrade xen-kmp-traceUpgrade xen | Dec 18, 2015 | Oct 30, 2015 |
| Ubuntu | — | Upgrade xen | Nov 19, 2024 | Oct 30, 2015 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub