PT-2013-3467 · Xen+1 · Xen+1

Publicado 2013-05-13 · Atualizado 2024-06-15 · CVE-2013-1917

Positive Technologies (AI Summary)

CVSS v2.0

1.9

Baixa

Vetor base

AV:L/AC:M/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Xen versions 3.1 through 4.x

Description The issue allows PV guest users to cause a denial of service by triggering a #GP fault, which is not properly handled, leading to a hypervisor crash. This occurs when running 64-bit hosts on Intel CPUs and using an IRET after a SYSENTER instruction without clearing the NT flag.

Recommendations For Xen versions 3.1 through 4.x, consider applying a patch that properly handles #GP faults and clears the NT flag when using an IRET after a SYSENTER instruction to prevent hypervisor crashes.

Correção

DoS

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2013-1917

DSA-2662-1

OPENSUSE-SU-2024:10196-1

SUSE-SU-2013_1075-1

Produtos afetados

Suse

Xen

Referências · 175

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2078 · Nota de Segurança
• https://osv.dev/vulnerability/openSUSE-SU-2024:10196-1 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2014-3672 · Nota
• https://suse.com/security/cve/CVE-2015-7970 · Nota
• http://lists.opensuse.org/opensuse-updates/2013-06/msg00049.html · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-1917 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2016-2538 · Nota
• https://suse.com/security/cve/CVE-2015-7969 · Nota
• https://suse.com/security/cve/CVE-2015-8615 · Nota
• https://suse.com/security/cve/CVE-2014-5146 · Nota
• https://suse.com/security/cve/CVE-2016-1981 · Nota
• http://lists.suse.com/mailman/listinfo/sle-security-updates · Nota
• https://suse.com/security/cve/CVE-2015-8550 · Nota
• https://suse.com/security/cve/CVE-2012-5513 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1917 · Nota de Segurança