PT-2013-5069 · Xen+2 · Xen+2

Jan Beulich · Published 2013-12-24 · Updated 2024-06-15 · CVE-2013-4554

Positive Technologies (AI Summary)

CVSS v2.0

5.2

Medium

Base vector

AV:A/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Xen versions 3.0.3 through 4.1.x Xen versions 4.2.x Xen versions 4.3.x

Description The issue allows local guest users to gain privileges via a crafted application running in ring 1 or 2, due to improper prevention of access to hypercalls.

Recommendations For Xen versions 3.0.3 through 4.1.x, update to a version that properly restricts access to hypercalls. For Xen versions 4.2.x, update to a version that properly restricts access to hypercalls. For Xen versions 4.3.x, update to a version that properly restricts access to hypercalls.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2013-4554

OPENSUSE-SU-2024:10196-1

RHSA-2014:0285

RHSA-2014_0285

Affected Products

Red Hat

Suse

Xen

References · 155

• https://bdu.fstec.ru/vul/2015-04307 · Security Note
• https://bdu.fstec.ru/vul/2015-04310 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2013-4554 · Security Note
• https://bdu.fstec.ru/vul/2014-00097 · Security Note
• https://bdu.fstec.ru/vul/2014-00089 · Security Note
• https://bdu.fstec.ru/vul/2015-04309 · Security Note
• http://lists.opensuse.org/opensuse-updates/2013-12/msg00059.html · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10196-1 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2014-0285.html · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-201407-03.xml · Vendor Advisory
• https://bdu.fstec.ru/vul/2014-00099 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2014-04/msg00000.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-04308 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00021.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00010.html · Vendor Advisory