Xen 3.0.3 through 4.1.x (possibly 4.1.6.1), 4.2.x (possibly 4.2.3), and 4.3.x (possibly 4.3.1) does not properly prevent access to hypercalls, which allows local guest users to gain privileges via a crafted application running in ring 1 or 2.
CVSS Details
- CVSS 3.1 Base Score: 5.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade kernel-docUpgrade kernel-xen-develUpgrade kernel-develUpgrade kernel-debugUpgrade kernel-PAEUpgrade kernel-PAE-develUpgrade kernelUpgrade kernel-debug-develUpgrade kernel-headersUpgrade kernel-xen | Dec 1, 2016 | Dec 24, 2013 |
| Gentoo Linux | — | Upgrade app-emulations/xen-tools.Upgrade app-emulations/xen-pvgrub.Upgrade app-emulations/xen. | Oct 30, 2017 | Dec 24, 2013 |
| Oracle_linux | — | Upgrade kernel | Oct 16, 2024 | Dec 24, 2013 |
| Suse | — | Upgrade sle-sdk-releaseUpgrade xen-libsUpgrade xen-kmp-paeUpgrade xen-kmp-kdumppaeUpgrade xen-doc-pdfUpgrade xen-libs-32bitUpgrade xen-kmp-vmiUpgrade xen-toolsUpgrade xen-kmp-desktopUpgrade xen-xend-toolsUpgrade xen-tools-ioemuUpgrade xen-kmp-smpUpgrade xen-kmp-bigsmpUpgrade xen-kmp-defaultUpgrade xenUpgrade xen-tools-domUUpgrade xen-doc-psUpgrade xen-develUpgrade xen-doc-htmlUpgrade xen-kmp-vmipaeUpgrade xen-kmp-kdumpUpgrade xen-kmp-debugUpgrade xen-kmp-trace | Dec 23, 2013 | Dec 23, 2013 |
| Ubuntu | — | Upgrade xen | Nov 19, 2024 | Dec 24, 2013 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub