The PV domain builder in Xen 4.2 and earlier does not validate the size of the kernel or ramdisk (1) before or (2) after decompression, which allows local guest administrators to cause a denial of service (domain 0 memory consumption) via a crafted (a) kernel or (b) ramdisk.
CVSS Details
- CVSS 3.1 Base Score: 4
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade xen-libsUpgrade xenUpgrade xen-devel | Dec 1, 2016 | Oct 31, 2012 |
| Debian | — | Upgrade xen | Jul 30, 2024 | Oct 31, 2012 |
| Oracle_linux | — | Upgrade xen-develUpgrade xen-libsUpgrade xen | Oct 16, 2024 | Oct 31, 2012 |
| Suse | — | Upgrade libvirt-develUpgrade xen-doc-pdfUpgrade xen-libs-32bitUpgrade libvirt-devel-32bitUpgrade xenUpgrade xen-kmp-paeUpgrade libvirt-client-32bitUpgrade xen-kmp-defaultUpgrade libvirt-clientUpgrade libvirt-docUpgrade xen-libsUpgrade xen-tools-domUUpgrade libvirt-pythonUpgrade xen-develUpgrade vm-installUpgrade xen-toolsUpgrade libvirtUpgrade xen-kmp-traceUpgrade xen-doc-html | Feb 17, 2015 | Jun 28, 2013 |
| Ubuntu | — | Upgrade xen | Nov 19, 2024 | Oct 31, 2012 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub