PT-2013-2134 · Xen · Xen

Published 2013-03-07 · Updated 2024-06-15 · CVE-2013-0151

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:A/AC:H/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Xen version 4.2.x

Description The issue allows guest OS users to cause a denial of service by leveraging administrative access to an HVM guest in a domain with a large number of VCPUs, resulting in long-duration page mappings and host OS crash. This is due to the do hvm op function not preventing HVM PARAM NESTEDHVM operations.

Recommendations For Xen version 4.2.x, consider restricting administrative access to HVM guests or limiting the number of VCPUs in a domain to minimize the risk of exploitation. As a temporary workaround, consider disabling the do hvm op function or restricting HVM PARAM NESTEDHVM operations until a patch is available.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2013-0151

OPENSUSE-SU-2024:10196-1

Affected Products

Xen

References · 130

• https://osv.dev/vulnerability/openSUSE-SU-2024:10196-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-0151 · Security Note
• http://security.gentoo.org/glsa/glsa-201309-24.xml · Vendor Advisory
• http://xenbits.xen.org/gitweb/?p=xen.git%3Ba=commit%3Bh=d60d7082289a74e44b3dc8f67df46c3404ca08bf · Note
• https://suse.com/security/cve/CVE-2012-5515 · Note
• https://suse.com/security/cve/CVE-2015-8339 · Note
• https://suse.com/security/cve/CVE-2015-4106 · Note
• https://suse.com/security/cve/CVE-2015-5307 · Note
• https://suse.com/security/cve/CVE-2015-8104 · Note
• https://suse.com/security/cve/CVE-2014-7155 · Note
• https://suse.com/security/cve/CVE-2016-5238 · Note
• https://suse.com/security/cve/CVE-2015-6815 · Note
• https://suse.com/security/cve/CVE-2015-8744 · Note
• https://suse.com/security/cve/CVE-2012-5513 · Note
• https://suse.com/security/cve/CVE-2015-7549 · Note