Xen 3.4 through 4.2, and possibly earlier versions, does not properly synchronize the p2m and m2p tables when the set_p2m_entry function fails, which allows local HVM guest OS administrators to cause a denial of service (memory consumption and assertion failure), aka "Memory mapping failure DoS vulnerability."
CVSS Details
- CVSS 3.1 Base Score: 5.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade xen | Aug 30, 2017 | Dec 13, 2012 |
| Centos_linux | — | Upgrade kernel-debugUpgrade kernel-debug-develUpgrade kernelUpgrade kernel-develUpgrade kernel-headersUpgrade kernel-xen-develUpgrade kernel-docUpgrade kernel-PAE-develUpgrade kernel-xenUpgrade kernel-PAE | Dec 1, 2016 | Nov 21, 2012 |
| Debian | — | Upgrade xen | Jul 30, 2024 | Nov 21, 2012 |
| Gentoo Linux | — | Upgrade app-emulation/xen.Upgrade app-emulation/xen-tools.Upgrade app-emulation/xen-pvgrub.Upgrade app-emulation/pvgrub. | Oct 30, 2017 | Nov 21, 2012 |
| Oracle_linux | — | Upgrade kernel | Oct 16, 2024 | Nov 21, 2012 |
| Suse | — | Upgrade vm-installUpgrade xen-toolsUpgrade libvirtUpgrade xen-doc-htmlUpgrade xen-tools-domUUpgrade xen-develUpgrade xen-libsUpgrade libvirt-pythonUpgrade libvirt-docUpgrade libvirt-clientUpgrade xenUpgrade xen-kmp-traceUpgrade xen-kmp-paeUpgrade libvirt-client-32bitUpgrade libvirt-devel-32bitUpgrade libvirt-develUpgrade xen-doc-pdfUpgrade xen-libs-32bitUpgrade xen-kmp-default | Feb 17, 2015 | Jun 27, 2013 |
| Ubuntu | — | Upgrade xen | Nov 19, 2024 | Nov 21, 2012 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub