The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
Xen 4.2.x, 4.1.x, and earlier, when the hypervisor is running "under memory pressure" and the Xen Security Module (XSM) is enabled, uses the wrong ordering of operations when extending the per-domain event channel tracking table, which causes a use-after-free and allows local guest kernels to inject arbitrary events and gain privileges via unspecified vectors.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Gentoo Linux | — | Upgrade app-emulation/xen.Upgrade app-emulation/xen-tools.Upgrade app-emulation/xen-pvgrub. | Oct 30, 2017 | Apr 12, 2013 |
| Suse | — | Upgrade xen-kmp-smpUpgrade xen-kmp-desktopUpgrade xen-develUpgrade xen-kmp-debugUpgrade xen-toolsUpgrade xen-kmp-vmipaeUpgrade xen-kmp-vmiUpgrade xen-doc-psUpgrade xen-kmp-kdumppaeUpgrade xen-kmp-bigsmpUpgrade xen-tools-domUUpgrade xen-libs-32bitUpgrade sle-sdk-releaseUpgrade xen-doc-htmlUpgrade xen-doc-pdfUpgrade xen-kmp-paeUpgrade xen-kmp-kdumpUpgrade xen-libsUpgrade xen-kmp-defaultUpgrade xen-kmp-traceUpgrade xenUpgrade xen-tools-ioemu | Feb 17, 2015 | Apr 12, 2013 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub