PT-2013-5043 · Xen+2 · Xen+2

Andrew Cooper · Published 2013-11-02 · Updated 2024-06-15 · CVE-2013-4494

Positive Technologies (AI Summary)

CVSS v2.0

5.2

Medium

Base vector

AV:A/AC:M/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Xen versions prior to 4.1.x, 4.2.x, and 4.3.x

Description The issue allows local guest administrators with access to multiple vcpus to cause a denial of service (host deadlock) due to the incorrect locking order of page alloc lock and grant table.lock.

Recommendations For versions prior to 4.1.x, 4.2.x, and 4.3.x, at the moment, there is no information about a newer version that contains a fix for this issue.

Fix

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2013-4494

DSA-3006-1

OPENSUSE-SU-2024:10196-1

RHSA-2014:0108

RHSA-2014_0108

SUSE-SU-2013_1867-1

Affected Products

Red Hat

Suse

Xen

References · 147

• https://osv.dev/vulnerability/openSUSE-SU-2024:10196-1 · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-201407-03.xml · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2013-4494 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00015.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4494 · Security Note
• http://debian.org/security/2014/dsa-3006 · Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2013-12/msg00059.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2014-0108.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2014-04/msg00000.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-4494 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-4494 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00021.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2013-4494 · Vendor Advisory
• https://suse.com/security/cve/CVE-2014-3672 · Note
• https://suse.com/security/cve/CVE-2015-7970 · Note