The XEN_DOMCTL_getmemlist hypercall in Xen 3.4.x through 4.3.x (possibly 4.3.1) does not always obtain the page_alloc_lock and mm_rwlock in the same order, which allows local guest administrators to cause a denial of service (host deadlock).
CVSS Details
- CVSS 3.1 Base Score: 4.4
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade xen | Jul 30, 2024 | Dec 24, 2013 |
| Gentoo Linux | — | Upgrade app-emulations/xen-tools.Upgrade app-emulations/xen-pvgrub.Upgrade app-emulations/xen. | Oct 30, 2017 | Dec 24, 2013 |
| Suse | — | Upgrade xen-kmp-defaultUpgrade xenUpgrade xen-kmp-desktopUpgrade xen-toolsUpgrade xen-doc-pdfUpgrade xen-libs-32bitUpgrade xen-libsUpgrade xen-develUpgrade xen-kmp-traceUpgrade sle-sdk-releaseUpgrade xen-xend-toolsUpgrade xen-doc-htmlUpgrade xen-kmp-paeUpgrade xen-tools-domU | Dec 23, 2013 | Dec 23, 2013 |
| Ubuntu | — | Upgrade xen | Nov 19, 2024 | Dec 24, 2013 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub