PT-2013-4979 · Xen+1 · Xen+1

Matthew Daley · Publicado 2013-10-17 · Atualizado 2017-01-07 · CVE-2013-4371

Positive Technologies (AI Summary)

CVSS v2.0

4.4

Média

Vetor base

AV:L/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Xen versions 4.2.x through 4.3.x

Description The issue is related to a use-after-free vulnerability in the libxl list cpupool function. This vulnerability can be triggered when the system is under memory pressure and the realloc function fails, causing the function to return the original pointer. As a result, local users may be able to cause a denial of service, leading to heap corruption and a crash, and potentially execute arbitrary code.

Recommendations For Xen versions 4.2.x through 4.3.x, consider applying a patch or update that fixes the use-after-free vulnerability in the libxl list cpupool function to prevent potential denial of service and code execution attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Enumeração de Fraquezas

CWE-399

Identificadores relacionados

CVE-2013-4371

Produtos afetados

Suse

Xen

Referências · 6

• https://nvd.nist.gov/vuln/detail/CVE-2013-4371 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2013-4371 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-4371 · Aviso do Fabricante
• http://security.gentoo.org/glsa/glsa-201407-03.xml · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2013/10/10/12 · Nota
• https://security-tracker.debian.org/tracker/CVE-2013-4371 · Aviso do Fabricante