Description
Xen 4.x, when downgrading the grant table version, does not properly remove the status page from the tracking list when freeing the page, which allows local guest OS administrators to cause a denial of service (hypervisor crash) via unspecified vectors.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | xen | 4.1.3-5 | — |
| Debian 13 | xen | 4.1.3-5 | — |
| Debian 12 | xen | 4.1.3-5 | — |
| Debian 6.0 | xen | 4.0.1-5.5 | DSA-2582-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | xen | 4.7.0_12-1.3 | openSUSE-SU-2024:10196-1 |
Advisories 2
- DSA-2582-1 xen - denial of service Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10196-1 xen-4.7.0_12-1.3 on GA media SUSE / openSUSE Security Updates · May 7, 2025
References
- [oss-security] 20121203 Xen Security Advisory 26 (CVE-2012-5510) - Grant table version switch list corruption vulnerability mailing-list
- 55082 third-party-advisory
- openSUSE-SU-2013:0133 vendor-advisory
- openSUSE-SU-2013:0637 vendor-advisory
- http://support.citrix.com/article/CTX135777
- GLSA-201309-24 vendor-advisory
- DSA-2582 vendor-advisory
- 51397 third-party-advisory
- openSUSE-SU-2012:1685 vendor-advisory
- 51486 third-party-advisory
- 51487 third-party-advisory
- 56794 vdb-entry
- 51468 third-party-advisory
- openSUSE-SU-2013:0636 vendor-advisory
- SUSE-SU-2014:0446 vendor-advisory
- openSUSE-SU-2012:1687 vendor-advisory
- 88128 vdb-entry
- xen-grant-table-dos(80478) vdb-entry
- SUSE-SU-2012:1615 vendor-advisory