PT-2013-6032 · Xen+1 · Xen+1

Jan Beulich · Publicado 2013-12-13 · Atualizado 2017-01-07 · CVE-2013-6400

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:A/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Xen versions 4.2.x through 4.3.x

Description The issue occurs when Xen is used with Intel VT-d and a PCI device has been assigned. It does not clear the flag that suppresses IOMMU TLB flushes when unspecified errors occur, causing the TLB entries to not be flushed. This allows local guest administrators to cause a denial of service (host crash) or gain privileges via unspecified vectors.

Recommendations For versions 4.2.x through 4.3.x, consider disabling the use of Intel VT-d with PCI device assignment until a patch is available to clear the flag that suppresses IOMMU TLB flushes when errors occur.

Correção

DoS

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2013-6400

Produtos afetados

Suse

Xen

Referências · 12

• https://osv.dev/vulnerability/DEBIAN-CVE-2013-6400 · Aviso do Fabricante
• http://security.gentoo.org/glsa/glsa-201407-03.xml · Aviso do Fabricante
• http://securitytracker.com/id/1029468 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2013-6400 · Nota de Segurança
• https://security-tracker.debian.org/tracker/CVE-2013-6400 · Aviso do Fabricante
• http://lists.fedoraproject.org/pipermail/package-announce/2013-December/125081.html · Aviso do Fabricante
• http://lists.fedoraproject.org/pipermail/package-announce/2013-December/125111.html · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2013-6400 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2013/12/10/7 · Nota
• http://lists.xen.org/archives/html/xen-announce/2013-12/msg00002.html · Nota
• http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00011.html · Aviso do Fabricante
• http://secunia.com/advisories/55932 · Aviso do Fabricante