Description
Memory leak in Xen 4.2 and unstable allows local HVM guests to cause a denial of service (host memory consumption) by performing nested virtualization in a way that triggers errors that are not properly handled.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | xen | 4.7.0_12-1.3 | openSUSE-SU-2024:10196-1 |
Advisories 1
- openSUSE-SU-2024:10196-1 xen-4.7.0_12-1.3 on GA media SUSE / openSUSE Security Updates · May 7, 2025
References
- 55082 third-party-advisory
- 1028032 vdb-entry
- GLSA-201309-24 vendor-advisory
- [oss-security] 20130123 Xen Security Advisory 35 (CVE-2013-0152) - Nested HVM exposes host to being driven out of memory by guest mailing-list