The PV domain builder in Xen 4.2 and earlier does not validate the size of the kernel or ramdisk (1) before or (2) after decompression, which allows local guest administrators to cause a denial of service (domain 0 memory consumption) via a crafted (a) kernel or (b) ramdisk.
CVSS Details
- CVSS 3.1 Base Score: 4
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade xenUpgrade xen-develUpgrade xen-libs | Dec 1, 2016 | Oct 31, 2012 |
| Debian | — | Upgrade xen | Jul 30, 2024 | Oct 31, 2012 |
| Oracle_linux | — | Upgrade xenUpgrade xen-libsUpgrade xen-devel | Oct 16, 2024 | Oct 31, 2012 |
| Suse | — | Upgrade libvirt-client-32bitUpgrade libvirt-develUpgrade libvirt-clientUpgrade xen-kmp-paeUpgrade xen-kmp-defaultUpgrade xen-doc-pdfUpgrade xen-libs-32bitUpgrade xenUpgrade libvirt-devel-32bitUpgrade libvirtUpgrade xen-libsUpgrade libvirt-pythonUpgrade vm-installUpgrade xen-tools-domUUpgrade xen-kmp-traceUpgrade xen-doc-htmlUpgrade xen-develUpgrade libvirt-docUpgrade xen-tools | Feb 17, 2015 | Jun 28, 2013 |
| Ubuntu | — | Upgrade xen | Nov 19, 2024 | Oct 31, 2012 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub