489 results · Feed
-
Medium 5.5
xenstored: A transaction conflict can crash C Xenstored
When a transaction is committed, C Xenstored will first check the quota is correct before attempting to commit any nodes. It would be possible that accounting is temporarily negative if a node has been removed outside of the transaction. Unfortunately, some v…
-
High 7.8
top-level shadow reference dropped too early for 64-bit PV guests
For migration as well as to work around kernels unaware of L1TF (see XSA-273), PV guests may be run in shadow paging mode. Since Xen itself needs to be mapped when PV guests run, Xen and shadowed PV guests run directly the respective shadow page tables. For 6…
-
Low 3.3
arm32: The cache may not be properly cleaned/invalidated
Arm provides multiple helpers to clean & invalidate the cache for a given region. This is, for instance, used when allocating guest memory to ensure any writes (such as the ones during scrubbing) have reached memory before handing over the page to a guest. Un…
-
Unscored —
arm: Guests can trigger a deadlock on Cortex-A77
Cortex-A77 cores (r0p0 and r1p0) are affected by erratum 1508412 where software, under certain circumstances, could deadlock a core due to the execution of either a load to device or non-cacheable memory, and either a store exclusive or register read of the P…
-
Unscored —CVE-2023-20588 EPSS 11%
Speculative Leaks
A division-by-zero error on some AMD processors can potentially return speculative data resulting in loss of confidentiality.
-
Low 3.3
Mishandling of guest SSBD selection on AMD hardware The current logic to set SSBD on AMD Family 17h and Hygon Family 18…
-
Unscored —
x86 shadow paging arbitrary pointer dereference In environments where host assisted address translation is necessary bu…
-
Unscored —
x86 shadow plus log-dirty mode use-after-free In environments where host assisted address translation is necessary but …
-
Unscored —
x86/HVM pinned cache attributes mis-handling T[his CNA information record relates to multiple CVEs; the text explains w…
-
Unscored —
x86: speculative vulnerability in 32bit SYSCALL path Due to an oversight in the very original Spectre/Meltdown security…
-
Unscored —
x86/HVM pinned cache attributes mis-handling T[his CNA information record relates to multiple CVEs; the text explains w…
-
Unscored —
When SMT is enabled, certain AMD processors may speculatively execute instructions using a target from the sibling thre…
-
Unscored —
Guests can cause Xenstore crash via soft reset When a guest issues a "Soft Reset" (e.g. for performing a kexec) the lib…
-
Unscored —
IBPB may not prevent return branch predictions from being specified by pre-IBPB branch targets leading to a potential i…
-
Medium 6.5
Xenstore: guests can let run xenstored out of memory T[his CNA information record relates to multiple CVEs; the text ex…
-
Medium 6.5
Xenstore: guests can let run xenstored out of memory T[his CNA information record relates to multiple CVEs; the text ex…
-
Unscored —
Xenstore: Guests can crash xenstored Due to a bug in the fix of XSA-115 a malicious guest can cause xenstored to use a …
-
Unscored —
Oxenstored 32->31 bit integer truncation issues Integers in Ocaml are 63 or 31 bits of signed precision. The Ocaml Xenb…
-
Medium 6.5
Xenstore: guests can let run xenstored out of memory T[his CNA information record relates to multiple CVEs; the text ex…
-
Unscored —
Xenstore: Guests can create orphaned Xenstore nodes By creating multiple nodes inside a transaction resulting in an err…
-
Medium 6.5
Xenstore: guests can let run xenstored out of memory T[his CNA information record relates to multiple CVEs; the text ex…
-
Unscored —
Xenstore: Cooperating guests can create arbitrary numbers of nodes T[his CNA information record relates to multiple CVE…
-
Medium 6.5
Xenstore: guests can let run xenstored out of memory T[his CNA information record relates to multiple CVEs; the text ex…
-
Medium 5.5
Xenstore: Guests can create arbitrary number of nodes via transactions T[his CNA information record relates to multiple…
-
Unscored —
Xenstore: Guests can create arbitrary number of nodes via transactions T[his CNA information record relates to multiple…
-
Medium 6.5
Xenstore: guests can let run xenstored out of memory T[his CNA information record relates to multiple CVEs; the text ex…
-
High 7.1
x86: unintended memory sharing between guests On Intel systems that support the "virtualize APIC accesses" feature, a g…
-
Unscored —
Xenstore: Guests can cause Xenstore to not free temporary memory When working on a request of a guest, xenstored might …
-
Unscored —
Xenstore: Guests can get access to Xenstore nodes of deleted domains Access rights of Xenstore nodes are per domid. Whe…
-
Medium 6.5
Xenstore: guests can let run xenstored out of memory T[his CNA information record relates to multiple CVEs; the text ex…
-
Unscored —
Xenstore: Cooperating guests can create arbitrary numbers of nodes T[his CNA information record relates to multiple CVE…
-
Unscored —
Xenstore: Guests can crash xenstored via exhausting the stack Xenstored is using recursion for some Xenstore operations…
-
Medium 6.5
Xenstore: guests can let run xenstored out of memory T[his CNA information record relates to multiple CVEs; the text ex…
-
Unscored —
Arm: unbounded memory consumption for 2nd-level page tables Certain actions require e.g. removing pages from a guest's …
-
Unscored —
P2M pool freeing may take excessively long The P2M pool backing second level address translation for guests may be of s…
-
Unscored —
lock order inversion in transitive grant copy handling As part of XSA-226 a missing cleanup call was inserted on an err…
-
Unscored —
insufficient TLB flush for x86 PV guests in shadow mode For migration as well as to work around kernels unaware of L1TF…
-
Unscored —
Aliases in the branch predictor may cause some AMD processors to predict the wrong branch type potentially leading to i…
-
Unscored —CVE-2022-29900 Public exploit
Mis-trained branch predictions for return instructions may allow arbitrary speculative code execution under certain mic…
-
Unscored —
Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text explains which aspe…