PT-2013-4979 · Xen+1 · Xen+1

Matthew Daley · Published 2013-10-17 · Updated 2017-01-07 · CVE-2013-4371

Positive Technologies (AI Summary)

CVSS v2.0

4.4

Medium

Base vector

AV:L/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Xen versions 4.2.x through 4.3.x

Description The issue is related to a use-after-free vulnerability in the libxl list cpupool function. This vulnerability can be triggered when the system is under memory pressure and the realloc function fails, causing the function to return the original pointer. As a result, local users may be able to cause a denial of service, leading to heap corruption and a crash, and potentially execute arbitrary code.

Recommendations For Xen versions 4.2.x through 4.3.x, consider applying a patch or update that fixes the use-after-free vulnerability in the libxl list cpupool function to prevent potential denial of service and code execution attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Weakness Enumeration

CWE-399

Related Identifiers

CVE-2013-4371

Affected Products

Suse

Xen

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2013-4371 · Security Note
• https://osv.dev/vulnerability/CVE-2013-4371 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-4371 · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-201407-03.xml · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2013-4371 · Vendor Advisory
• http://openwall.com/lists/oss-security/2013/10/10/12 · Note