The (1) ioport_read and (2) ioport_write functions in Xen, when qemu is used as a device model within Xen, might allow local x86 HVM guest OS administrators to gain qemu process privileges via vectors involving an out-of-range ioport access.
CVSS Details
- CVSS 3.0 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade xen-develUpgrade xenUpgrade xen-libs | Jan 27, 2017 | Dec 7, 2016 |
| Debian | — | Upgrade xen | Feb 20, 2019 | Feb 16, 2017 |
| Gentoo Linux | — | Upgrade app-emulation/xen.Upgrade app-emulation/xen-pvgrub.Upgrade app-emulation/xen-tools. | Oct 30, 2017 | Feb 16, 2017 |
| Oracle_linux | — | Upgrade xen-develUpgrade xen-libsUpgrade xen | Dec 21, 2016 | Dec 6, 2016 |
| Redhat_linux | — | Upgrade xen-debuginfoUpgrade xenUpgrade xen-develUpgrade xen-libs | Dec 21, 2016 | Dec 7, 2016 |
| Suse | — | Upgrade xen-libs-32bitUpgrade xen-tools-xendomains-wait-diskUpgrade xen-kmp-paeUpgrade xen-develUpgrade xen-toolsUpgrade xen-doc-pdfUpgrade xen-libsUpgrade xen-doc-htmlUpgrade xen-kmp-defaultUpgrade xen-tools-domUUpgrade xen-kmp-traceUpgrade xen | Dec 9, 2016 | Dec 7, 2016 |
| Ubuntu | — | Upgrade xen | Nov 19, 2024 | Feb 17, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub