Xen 3.0.3 through 4.1.x (possibly 4.1.6.1), 4.2.x (possibly 4.2.3), and 4.3.x (possibly 4.3.1) does not properly prevent access to hypercalls, which allows local guest users to gain privileges via a crafted application running in ring 1 or 2.
CVSS Details
- CVSS 3.1 Base Score: 5.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade kernel-xenUpgrade kernel-debug-develUpgrade kernel-PAEUpgrade kernelUpgrade kernel-headersUpgrade kernel-PAE-develUpgrade kernel-develUpgrade kernel-debugUpgrade kernel-docUpgrade kernel-xen-devel | Dec 1, 2016 | Dec 24, 2013 |
| Gentoo Linux | — | Upgrade app-emulations/xen-tools.Upgrade app-emulations/xen.Upgrade app-emulations/xen-pvgrub. | Oct 30, 2017 | Dec 24, 2013 |
| Oracle_linux | — | Upgrade kernel | Oct 16, 2024 | Dec 24, 2013 |
| Suse | — | Upgrade xen-kmp-vmiUpgrade xen-doc-pdfUpgrade xen-kmp-desktopUpgrade xen-tools-ioemuUpgrade xen-xend-toolsUpgrade sle-sdk-releaseUpgrade xen-libs-32bitUpgrade xen-kmp-paeUpgrade xen-kmp-bigsmpUpgrade xen-libsUpgrade xen-kmp-smpUpgrade xen-toolsUpgrade xen-kmp-kdumppaeUpgrade xen-kmp-vmipaeUpgrade xen-kmp-traceUpgrade xen-kmp-debugUpgrade xen-tools-domUUpgrade xen-doc-htmlUpgrade xen-kmp-kdumpUpgrade xen-kmp-defaultUpgrade xen-develUpgrade xenUpgrade xen-doc-ps | Dec 23, 2013 | Dec 23, 2013 |
| Ubuntu | — | Upgrade xen | Nov 19, 2024 | Dec 24, 2013 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub