The (1) ioport_read and (2) ioport_write functions in Xen, when qemu is used as a device model within Xen, might allow local x86 HVM guest OS administrators to gain qemu process privileges via vectors involving an out-of-range ioport access.
CVSS Details
- CVSS 3.0 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade xen-libsUpgrade xen-develUpgrade xen | Jan 27, 2017 | Dec 7, 2016 |
| Debian | — | Upgrade xen | Feb 20, 2019 | Feb 16, 2017 |
| Gentoo Linux | — | Upgrade app-emulation/xen.Upgrade app-emulation/xen-pvgrub.Upgrade app-emulation/xen-tools. | Oct 30, 2017 | Feb 16, 2017 |
| Oracle_linux | — | Upgrade xen-libsUpgrade xen-develUpgrade xen | Dec 21, 2016 | Dec 6, 2016 |
| Redhat_linux | — | Upgrade xen-develUpgrade xen-libsUpgrade xenUpgrade xen-debuginfo | Dec 21, 2016 | Dec 7, 2016 |
| Suse | — | Upgrade xen-kmp-paeUpgrade xen-tools-xendomains-wait-diskUpgrade xen-doc-pdfUpgrade xen-develUpgrade xen-libs-32bitUpgrade xen-toolsUpgrade xen-kmp-traceUpgrade xenUpgrade xen-libsUpgrade xen-tools-domUUpgrade xen-doc-htmlUpgrade xen-kmp-default | Dec 9, 2016 | Dec 7, 2016 |
| Ubuntu | — | Upgrade xen | Nov 19, 2024 | Feb 17, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub