Description
The hvm_msr_read_intercept function in arch/x86/hvm/hvm.c in Xen 4.1 through 4.4.x uses an improper MSR range for x2APIC emulation, which allows local HVM guests to cause a denial of service (host crash) or read data from the hypervisor or other guests via unspecified vectors.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | xen | 4.4.1-3 | — |
| Debian 13 | xen | 4.4.1-3 | — |
| Debian 12 | xen | 4.4.1-3 | — |
| Debian 7 | xen | 4.1.4-3+deb7u3 | DSA-3041-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | xen | 4.4.0-0ubuntu5.2 | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | xen | 4.7.0_12-1.3 | openSUSE-SU-2024:10196-1 |
Advisories 2
- DSA-3041-1 xen - security update Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10196-1 xen-4.7.0_12-1.3 on GA media SUSE / openSUSE Security Updates · May 7, 2025
References
- openSUSE-SU-2014:1281 vendor-advisory
- FEDORA-2014-12000 vendor-advisory
- http://support.citrix.com/article/CTX201794
- openSUSE-SU-2014:1279 vendor-advisory
- http://support.citrix.com/article/CTX200218
- FEDORA-2014-12002 vendor-advisory
- http://www.c7zero.info/stuff/csw2017_ExploringYourSystemDeeper_updated.pdf
- 1030936 vdb-entry
- http://xenbits.xen.org/xsa/advisory-108.html
- FEDORA-2014-12036 vendor-advisory
- 61664 third-party-advisory
- DSA-3041 vendor-advisory
- 61858 third-party-advisory
- 61890 third-party-advisory
- GLSA-201412-42 vendor-advisory
- xen-cve20147188-dos(96785) vdb-entry
- 70198 vdb-entry