xend in Xen 3.0.3 does not properly limit the contents of the /local/domain xenstore directory tree, and does not properly restrict a guest VM's write access within this tree, which allows guest OS users to cause a denial of service and possibly have unspecified other impact by writing to (1) console/tty, (2) console/limit, or (3) image/device-model-pid. NOTE: this issue was originally reported as an issue in libvirt 0.3.3 and xenstore, but CVE is considering the core issue to be related to Xen.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade xenUpgrade xen-libsUpgrade xen-devel | Dec 1, 2016 | Oct 3, 2008 |
| Oracle_linux | — | Upgrade xenUpgrade xen-develUpgrade xen-libs | Oct 16, 2024 | Oct 3, 2008 |
| Suse | — | Upgrade xen-tools-domUUpgrade xenUpgrade xen-doc-htmlUpgrade xen-develUpgrade xen-toolsUpgrade xen-libsUpgrade xen-doc-pdf | Feb 17, 2015 | Oct 3, 2008 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub