PT-2016-4865 · Xen+1 · Xen+1

Jan Beulich · Publicado 2016-01-22 · Atualizado 2024-06-15 · CVE-2016-1571

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Média

Vetor base

AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Xen versions 3.3.x through 4.6.x

Description The issue allows local HVM guest users to cause a denial of service (host crash) via a non-canonical guest address in an INVVPID instruction. This occurs when using shadow mode paging or nested virtualization, and it triggers a hypervisor bug check.

Recommendations For Xen versions 3.3.x through 4.6.x, consider disabling shadow mode paging or nested virtualization as a temporary workaround to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Enumeração de Fraquezas

CWE-17

Identificadores relacionados

CVE-2016-1571

DLA-479-1

DSA-3519-1

MGASA-2016-0098

OPENSUSE-SU-2016_0995-1

OPENSUSE-SU-2024:10196-1

SUSE-SU-2016:0873-1

SUSE-SU-2016:0955-1

SUSE-SU-2016:1154-1

SUSE-SU-2016:1318-1

SUSE-SU-2016:1745-1

Produtos afetados

Suse

Xen

Referências · 292

• https://osv.dev/vulnerability/SUSE-SU-2016:0955-1 · Aviso do Fabricante
• https://bugzilla.suse.com/965156 · Nota
• http://xenbits.xen.org/xsa/advisory-121.html · Nota
• https://suse.com/security/cve/CVE-2014-3689 · Nota
• https://bugzilla.suse.com/864391 · Nota
• https://cve.org/CVERecord?id=CVE-2016-1571 · Nota de Segurança
• https://suse.com/security/cve/CVE-2014-3124 · Nota
• https://suse.com/security/cve/CVE-2015-4104 · Nota
• https://suse.com/security/cve/CVE-2016-4439 · Nota
• https://suse.com/security/cve/CVE-2014-7154 · Nota
• https://suse.com/security/cve/CVE-2013-4356 · Nota
• https://bugzilla.suse.com/969122 · Nota
• https://bugzilla.suse.com/967012 · Nota
• https://suse.com/security/cve/CVE-2013-4537 · Nota
• https://suse.com/security/cve/CVE-2012-6075 · Nota