Search for packages
| purl | pkg:deb/debian/xen@4.14.6-1?distro=trixie |
| Next non-vulnerable version | 4.16.0+51-g0941d6cb-1 |
| Latest non-vulnerable version | 4.20.2+7-g1badcf5035-1 |
| Risk | 3.0 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-1tb8-t91c-63bp
Aliases: CVE-2024-2201 XSA-456 |
x86: Native Branch History Injection |
Affected by 0 other vulnerabilities. Affected by 3 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 2 other vulnerabilities. Affected by 2 other vulnerabilities. |
|
VCID-26a9-9zz3-wfhh
Aliases: CVE-2025-58147 XSA-475 |
x86: Incorrect input sanitisation in Viridian hypercalls |
Affected by 3 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 2 other vulnerabilities. Affected by 2 other vulnerabilities. |
|
VCID-2trm-w3ww-cfhk
Aliases: CVE-2025-27466 |
Mutiple vulnerabilities in the Viridian interface |
Affected by 3 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 2 other vulnerabilities. Affected by 2 other vulnerabilities. |
|
VCID-3bw4-631f-e7h6
Aliases: CVE-2023-34321 XSA-437 |
arm32: The cache may not be properly cleaned/invalidated |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 3 other vulnerabilities. Affected by 2 other vulnerabilities. Affected by 2 other vulnerabilities. |
|
VCID-3se4-qv6j-xqfq
Aliases: CVE-2024-31143 XSA-458 |
double unlock in x86 guest IRQ handling |
Affected by 0 other vulnerabilities. Affected by 3 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 2 other vulnerabilities. Affected by 2 other vulnerabilities. |
|
VCID-3vdg-5g64-wkbt
Aliases: CVE-2023-46841 XSA-451 |
x86: shadow stack vs exceptions from emulation stubs |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 3 other vulnerabilities. Affected by 2 other vulnerabilities. Affected by 2 other vulnerabilities. |
|
VCID-46ad-1k9n-j3hm
Aliases: CVE-2022-26365 |
Linux disk/nic frontends data leaks |
Affected by 0 other vulnerabilities. Affected by 3 other vulnerabilities. Affected by 2 other vulnerabilities. Affected by 2 other vulnerabilities. |
|
VCID-4cdt-ycjx-6ub4
Aliases: CVE-2022-33741 XSA-403 |
Linux disk/nic frontends data leaks |
Affected by 0 other vulnerabilities. Affected by 3 other vulnerabilities. Affected by 2 other vulnerabilities. Affected by 2 other vulnerabilities. |
|
VCID-4k7p-3g95-n7dm
Aliases: CVE-2024-45818 XSA-463 |
Deadlock in x86 HVM standard VGA handling |
Affected by 0 other vulnerabilities. Affected by 3 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 2 other vulnerabilities. Affected by 2 other vulnerabilities. |
|
VCID-4pra-prf3-1uff
Aliases: CVE-2025-58149 XSA-476 |
Incorrect removal of permissions on PCI device unplug |
Affected by 3 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 2 other vulnerabilities. Affected by 2 other vulnerabilities. |
|
VCID-4rmg-db7g-u3hs
Aliases: CVE-2023-46839 XSA-449 |
pci: phantom functions assigned to incorrect contexts |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 3 other vulnerabilities. Affected by 2 other vulnerabilities. Affected by 2 other vulnerabilities. |
|
VCID-5ktg-bhh1-ubbz
Aliases: CVE-2023-34320 XSA-436 |
arm: Guests can trigger a deadlock on Cortex-A77 |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 3 other vulnerabilities. Affected by 2 other vulnerabilities. Affected by 2 other vulnerabilities. |
|
VCID-5u88-jt28-cfb6
Aliases: CVE-2025-1713 XSA-467 |
deadlock potential with VT-d and legacy PCI device pass-through |
Affected by 3 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 2 other vulnerabilities. Affected by 2 other vulnerabilities. |
|
VCID-6dax-cddv-7bbs
Aliases: CVE-2023-34328 XSA-444 |
x86/AMD: Debug Mask handling |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 3 other vulnerabilities. Affected by 2 other vulnerabilities. Affected by 2 other vulnerabilities. |
|
VCID-6jqj-2qwn-8qd9
Aliases: CVE-2023-34327 |
x86/AMD: Debug Mask handling |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 3 other vulnerabilities. Affected by 2 other vulnerabilities. Affected by 2 other vulnerabilities. |
|
VCID-8k1q-b2kj-w7hh
Aliases: CVE-2023-34325 XSA-443 |
Multiple vulnerabilities in libfsimage disk handling |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 3 other vulnerabilities. Affected by 2 other vulnerabilities. Affected by 2 other vulnerabilities. |
|
VCID-8tv5-zxmm-r3fk
Aliases: CVE-2023-20588 XSA-439 |
x86/AMD: Divide speculative information leak |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 3 other vulnerabilities. Affected by 2 other vulnerabilities. Affected by 2 other vulnerabilities. |
|
VCID-97zm-r9b6-uqdu
Aliases: CVE-2023-34323 XSA-440 |
xenstored: A transaction conflict can crash C Xenstored |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 3 other vulnerabilities. Affected by 2 other vulnerabilities. Affected by 2 other vulnerabilities. |
|
VCID-b57c-x3pw-7fb7
Aliases: CVE-2023-34322 XSA-438 |
top-level shadow reference dropped too early for 64-bit PV guests |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 3 other vulnerabilities. Affected by 2 other vulnerabilities. Affected by 2 other vulnerabilities. |
|
VCID-bhdk-jmss-4qc8
Aliases: CVE-2023-46836 XSA-446 |
x86: BTC/SRSO fixes not fully effective |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 3 other vulnerabilities. Affected by 2 other vulnerabilities. Affected by 2 other vulnerabilities. |
|
VCID-byu1-7n9c-5fes
Aliases: CVE-2024-2193 XSA-453 |
GhostRace: Speculative Race Conditions |
Affected by 0 other vulnerabilities. Affected by 3 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 2 other vulnerabilities. Affected by 2 other vulnerabilities. |
|
VCID-c4xu-szkm-1kh6
Aliases: CVE-2025-58145 |
Arm issues with page refcounting |
Affected by 3 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 2 other vulnerabilities. Affected by 2 other vulnerabilities. |
|
VCID-ee3z-24pr-kqcm
Aliases: CVE-2024-31145 XSA-460 |
error handling in x86 IOMMU identity mapping |
Affected by 0 other vulnerabilities. Affected by 3 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 2 other vulnerabilities. Affected by 2 other vulnerabilities. |
|
VCID-ejhc-6yqt-gkgv
Aliases: CVE-2024-28956 XSA-469 |
x86: Indirect Target Selection |
Affected by 3 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 2 other vulnerabilities. Affected by 2 other vulnerabilities. |
|
VCID-evcg-2z3p-gbch
Aliases: CVE-2024-31146 |
PCI device pass-through with shared resources |
Affected by 0 other vulnerabilities. Affected by 3 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 2 other vulnerabilities. Affected by 2 other vulnerabilities. |
|
VCID-h9hz-vur7-kyhg
Aliases: CVE-2025-58148 |
x86: Incorrect input sanitisation in Viridian hypercalls |
Affected by 3 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 2 other vulnerabilities. Affected by 2 other vulnerabilities. |
|
VCID-j22f-mbqe-a7dk
Aliases: CVE-2024-36350 |
x86: Transitive Scheduler Attacks |
Affected by 3 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 2 other vulnerabilities. Affected by 2 other vulnerabilities. |
|
VCID-p2fk-8snj-x7dy
Aliases: CVE-2023-28746 XSA-452 |
x86: Register File Data Sampling |
Affected by 0 other vulnerabilities. Affected by 3 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 2 other vulnerabilities. Affected by 2 other vulnerabilities. |
|
VCID-psaa-jdr7-e3fm
Aliases: CVE-2024-45819 XSA-464 |
libxl leaks data to PVH guests via ACPI tables |
Affected by 0 other vulnerabilities. Affected by 3 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 2 other vulnerabilities. Affected by 2 other vulnerabilities. |
|
VCID-q3p3-tgay-6kcs
Aliases: CVE-2022-33740 |
Linux disk/nic frontends data leaks |
Affected by 0 other vulnerabilities. Affected by 3 other vulnerabilities. Affected by 2 other vulnerabilities. Affected by 2 other vulnerabilities. |
|
VCID-qpfc-3296-9ub3
Aliases: CVE-2026-23553 XSA-479 |
x86: incomplete IBPB for vCPU isolation |
Affected by 2 other vulnerabilities. Affected by 2 other vulnerabilities. |
|
VCID-qsma-2ufh-jybe
Aliases: CVE-2026-23555 XSA-481 |
Xenstored DoS by unprivileged domain |
Affected by 3 other vulnerabilities. |
|
VCID-rdub-9bhg-nbc6
Aliases: CVE-2024-45817 XSA-462 |
x86: Deadlock in vlapic_error() |
Affected by 0 other vulnerabilities. Affected by 3 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 2 other vulnerabilities. Affected by 2 other vulnerabilities. |
|
VCID-rk2f-yqbb-nyd2
Aliases: CVE-2023-46837 XSA-447 |
arm32: The cache may not be properly cleaned/invalidated (take two) |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 3 other vulnerabilities. Affected by 2 other vulnerabilities. Affected by 2 other vulnerabilities. |
|
VCID-rt5n-e4wq-p3gh
Aliases: CVE-2023-46842 XSA-454 |
x86 HVM hypercalls may trigger Xen bug check |
Affected by 0 other vulnerabilities. Affected by 3 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 2 other vulnerabilities. Affected by 2 other vulnerabilities. |
|
VCID-tjgh-waa3-wqgk
Aliases: CVE-2025-58144 XSA-473 |
Arm issues with page refcounting |
Affected by 3 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 2 other vulnerabilities. Affected by 2 other vulnerabilities. |
|
VCID-upju-tcz7-efg1
Aliases: CVE-2025-58150 XSA-477 |
x86: buffer overrun with shadow paging + tracing |
Affected by 2 other vulnerabilities. Affected by 2 other vulnerabilities. |
|
VCID-uv8m-bj4c-8fes
Aliases: CVE-2024-36357 XSA-471 |
x86: Transitive Scheduler Attacks |
Affected by 3 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 2 other vulnerabilities. Affected by 2 other vulnerabilities. |
|
VCID-vv23-mvyn-87hg
Aliases: CVE-2025-58143 |
Mutiple vulnerabilities in the Viridian interface |
Affected by 3 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 2 other vulnerabilities. Affected by 2 other vulnerabilities. |
|
VCID-wd4s-jxuf-skbp
Aliases: CVE-2023-46835 XSA-445 |
x86/AMD: mismatch in IOMMU quarantine page table levels |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 3 other vulnerabilities. Affected by 2 other vulnerabilities. Affected by 2 other vulnerabilities. |
|
VCID-wz1m-aeaf-nkg7
Aliases: CVE-2025-58142 XSA-472 |
Mutiple vulnerabilities in the Viridian interface |
Affected by 3 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 2 other vulnerabilities. Affected by 2 other vulnerabilities. |
|
VCID-xqpz-y83m-4uc4
Aliases: CVE-2025-27465 XSA-470 |
x86: Incorrect stubs exception handling for flags recovery |
Affected by 3 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 2 other vulnerabilities. Affected by 2 other vulnerabilities. |
|
VCID-ye1t-qhtx-sucm
Aliases: CVE-2023-34326 XSA-442 |
x86/AMD: missing IOMMU TLB flushing |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 3 other vulnerabilities. Affected by 2 other vulnerabilities. Affected by 2 other vulnerabilities. |
|
VCID-z9rm-9p2q-wfag
Aliases: CVE-2024-31142 XSA-455 |
x86: Incorrect logic for BTC/SRSO mitigations |
Affected by 0 other vulnerabilities. Affected by 3 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 2 other vulnerabilities. Affected by 2 other vulnerabilities. |
|
VCID-zkeg-d5d5-vbda
Aliases: CVE-2022-33742 |
Linux disk/nic frontends data leaks |
Affected by 0 other vulnerabilities. Affected by 3 other vulnerabilities. Affected by 2 other vulnerabilities. Affected by 2 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-12wz-93wy-euhs | libxl leak of pv kernel and initrd on error |
CVE-2015-8341
|
| VCID-16hm-nyk9-5uff | stale P2M mappings due to insufficient error checking |
CVE-2017-10918
XSA-222 |
| VCID-184d-4jsf-yqed | improper bug check in x86 log-dirty handling |
CVE-2017-17565
XSA-251 |
| VCID-1ewg-kc47-bucs | XENMEM_exchange error handling issues |
CVE-2015-8340
|
| VCID-1gsb-q3au-2yaa | Xen domain builder Out-of-memory due to malicious kernel/ramdisk |
CVE-2012-2625
|
| VCID-1mnk-msa5-7bg8 | libxl partially sets up HVM passthrough even with disabled iommu |
CVE-2013-4329
|
| VCID-1muu-6ytt-jkc5 | grant table operations mishandle reference counts |
CVE-2017-10921
|
| VCID-1phh-s2rg-4ugh | resource accounting issues in x86 IOREQ server handling |
CVE-2018-19963
XSA-276 |
| VCID-1w8k-r3j4-8fbq | certain VT-d IOMMUs may not work in shared page table mode |
CVE-2021-28710
XSA-390 |
| VCID-1wgc-r96w-7kg9 | IRQ vector leak on x86 |
CVE-2021-3308
XSA-360 |
| VCID-1wtd-67ef-1qej | IOMMU page mapping issues on x86 |
CVE-2021-28695
|
| VCID-1x3w-n7ms-eqeh | oxenstored memory leak in reset_watches |
CVE-2020-29485
XSA-330 |
| VCID-1xn5-2d9n-vuc4 | Stale TLB entry due to page type release race |
CVE-2017-15588
XSA-241 |
| VCID-21bx-skks-s7gc | Missing p2m error checking in PoD code |
CVE-2017-17045
|
| VCID-21e6-1c41-1ban | Timer overflow DoS vulnerability |
CVE-2012-4535
|
| VCID-2534-cu4k-x3fs | XENMEM_exchange may overwrite hypervisor memory |
CVE-2012-5513
|
| VCID-285u-bk7z-sybs | PCI MSI mask bits inadvertently exposed to guests |
CVE-2015-4104
|
| VCID-28t2-hng7-tfe5 | missed flush in XSA-321 backport |
CVE-2021-27379
|
| VCID-2h35-vvte-g7cs | x86: CPU lockup during exception delivery |
CVE-2015-8104
|
| VCID-2ke1-fmf7-7ydt | passed through PCI devices may corrupt host memory after deassignment |
CVE-2019-18424
XSA-302 |
| VCID-2krx-ggcg-efaj | Vulnerabilities in HVM MSI injection |
CVE-2014-3968
|
| VCID-2n5n-1czt-skbu | delimiter injection vulnerabilities in pygrub |
CVE-2016-9379
|
| VCID-2n9p-6t7s-kqc5 | arm: The cache may not be cleaned for newly allocated scrubbed pages |
CVE-2021-26933
XSA-364 |
| VCID-2q8z-7gt6-j3a7 | 64-bit PV guest privilege escalation vulnerability |
CVE-2012-0217
|
| VCID-2qvr-9266-d7bt | x86 segment base write emulation lacking canonical address checks |
CVE-2016-9385
XSA-193 |
| VCID-2uap-2vm1-efcr | Retbleed - arbitrary speculative code execution with return instructions |
CVE-2022-29900
|
| VCID-2v7d-qp1d-tfac | Information leak via internal x86 system device emulation |
CVE-2015-2044
|
| VCID-2yke-a3ka-ubaq | Device quarantine for alternate pci assignment methods |
CVE-2019-19579
XSA-306 |
| VCID-3195-drgk-gkhx | input handling vulnerabilities loading guest kernel on ARM |
CVE-2014-3717
|
| VCID-32w3-vmcb-wfd9 | xen/arm: Boot modules are not scrubbed |
CVE-2021-28693
XSA-372 |
| VCID-33gz-5ke6-zqdn | Several memory hypercall operations allow invalid extent order values |
CVE-2012-5515
|
| VCID-3488-1xdv-4kc8 | Further issues with restartable PV type change operations |
CVE-2019-19580
XSA-310 |
| VCID-34gr-dtsz-1fab | x86: Race condition in Xen mapping code |
CVE-2020-27672
XSA-345 |
| VCID-34ng-ftbx-e3cm | Xenstore: guests can let run xenstored out of memory |
CVE-2022-42317
|
| VCID-3863-ejr7-5bfd | Races in the grant table unmap code |
CVE-2017-10913
|
| VCID-39t8-p1q7-eyag | Xenstore: guests can let run xenstored out of memory |
CVE-2022-42318
|
| VCID-3d53-4qtr-myhm | x86 shadow plus log-dirty mode use-after-free |
CVE-2022-42332
XSA-427 |
| VCID-3ead-rt5y-p3fw | Broken error handling in guest_physmap_mark_populate_on_demand() |
CVE-2012-5514
|
| VCID-3f57-by4f-77e4 | input handling vulnerabilities loading guest kernel on ARM |
CVE-2014-3715
|
| VCID-3pxf-xndw-5fft | Xenstore: guests can crash xenstored via watchs |
CVE-2020-29484
XSA-324 |
| VCID-3pzv-55sc-37ge | Bugs in dynamic height handling for AMD IOMMU pagetables |
CVE-2019-19577
XSA-311 |
| VCID-3q19-6ynd-6kb1 | nested virtualization on 32-bit exposes host crash |
CVE-2013-0151
|
| VCID-3qjm-4egs-1kax | Issues with restartable PV type change operations |
CVE-2019-18421
XSA-299 |
| VCID-3tjz-1jvw-8uc4 | insufficient cache write-back under VT-d |
CVE-2020-15565
XSA-321 |
| VCID-3whm-8fyv-zyhd | race when migrating timers between x86 HVM vCPU-s |
CVE-2020-25604
XSA-336 |
| VCID-416b-93m6-jyby | Xenstore: guests can let run xenstored out of memory |
CVE-2022-42313
|
| VCID-42ma-8ash-j7c8 | Xenstore: guests can let run xenstored out of memory |
CVE-2022-42311
|
| VCID-4428-3m75-93cx | insufficient permissions checks accessing guest memory on ARM |
CVE-2014-3969
|
| VCID-4429-qf2w-jqg3 | x86: MMIO Stale Data vulnerabilities |
CVE-2022-21166
XSA-404 |
| VCID-493n-hphq-akhy | non-atomic modification of live EPT PTE |
CVE-2020-15567
XSA-328 |
| VCID-49cz-nu6d-b7dq | x86 64-bit bit test instruction emulation broken |
CVE-2016-9383
XSA-195 |
| VCID-49x7-nf2n-4ya6 | arm: Host crash caused by VMID exhaustion |
CVE-2016-5242
|
| VCID-4ccg-4xa6-syak | several HVM operations do not validate the range of their inputs |
CVE-2012-6333
|
| VCID-4ftz-k9rh-jubk | x86 shadow paging arbitrary pointer dereference |
CVE-2022-42335
XSA-430 |
| VCID-4s4d-gnst-1qhw | multiple TMEM hypercall vulnerabilities |
CVE-2012-3497
|
| VCID-4spa-usqt-93b2 | x86 pv: Race condition in typeref acquisition |
CVE-2022-26362
XSA-401 |
| VCID-4w49-gjvc-mqcy | grant table operations mishandle reference counts |
CVE-2017-10920
XSA-224 |
| VCID-4xug-22db-7qg2 | Potential use of freed memory in event channel operations |
CVE-2013-1920
|
| VCID-4y3w-beqv-q7g5 | Information leak through version information hypercall |
CVE-2015-2045
|
| VCID-515s-df9v-wbab | x86: populate-on-demand balloon size inaccuracy can crash guests |
CVE-2015-7972
|
| VCID-51ck-7qgg-tfhp | x86: Uncontrolled creation of large page mappings by PV guests |
CVE-2015-7835
|
| VCID-55n8-eqfw-m3gd | Multiple vulnerabilities have been found in Xen, allowing attackers on a Xen Virtual Machine to execute arbitrary code, cause Denial of Service, or gain access to data on the host. |
CVE-2012-6030
|
| VCID-5aus-m6c9-k7f7 | Multiple vulnerabilities in libelf PV kernel handling |
CVE-2013-2195
|
| VCID-5cw7-rv5f-jfaq | insufficient TLB flush for x86 PV guests in shadow mode |
CVE-2022-33745
XSA-408 |
| VCID-5dbd-kz24-6fc1 | issues with partially successful P2M updates on x86 |
CVE-2021-28709
XSA-389 |
| VCID-5ebf-qqbc-63au | xen: Checks access permissions to MMIO ranges only after accessing them |
CVE-2017-7995
|
| VCID-5gab-898z-v7h5 | VMX: intercept issue with INVLPG on non-canonical address |
CVE-2016-1571
|
| VCID-5gua-j7zw-a7ex | qemu may drive Xen into unbounded loop |
CVE-2018-10981
XSA-262 |
| VCID-5jsd-ps57-fyde | Several access permission issues with IRQs for unprivileged guests |
CVE-2013-1919
|
| VCID-5km7-7wj4-tydz | xen: memory leak when destroying guest without PT devices (XSA-207) |
CVE-2017-14431
|
| VCID-5u4v-s281-jkab | Excessive checking in compatibility mode hypercall argument translation |
CVE-2014-8866
|
| VCID-5x39-ttxq-aygg | oxenstored incorrect handling of certain Xenbus ring states |
CVE-2013-0215
|
| VCID-61zz-uk19-r7b2 | x86: Inconsistent PV IOMMU discipline |
CVE-2019-17343
|
| VCID-64mf-wa98-rkha | x86: incorrect error handling for guest p2m page removals |
CVE-2018-19964
XSA-277 |
| VCID-6b1e-39na-b7gf | guest use of HLE constructs may lock up host |
CVE-2018-19967
XSA-282 |
| VCID-6bfh-5aed-mkcg | Guest effectable page reference leak in MMU_MACHPHYS_UPDATE handling |
CVE-2014-9030
|
| VCID-6jsn-7538-a7ha | L1 Terminal Fault speculative side channel |
CVE-2018-3646
XSA-273 |
| VCID-6kh6-edk7-xkcc | unsafe AMD IOMMU page table updates |
CVE-2020-27670
XSA-347 |
| VCID-6m7c-ceaj-ufem | paravirtualised kernel image validation |
CVE-2011-1583
|
| VCID-6rf8-uz52-rqh6 | ocaml xenstored mishandles oversized message replies |
CVE-2013-4416
|
| VCID-6s1x-qtmr-jkg4 | multiple MSI mapping issues on x86 |
CVE-2017-15590
XSA-237 |
| VCID-6tn5-hymv-3ffj | Xen PV DoS vulnerability with SYSENTER |
CVE-2013-1917
|
| VCID-6vxj-m9ud-5ke9 | Unlimited Arm Atomics Operations |
CVE-2019-17350
|
| VCID-6xbp-t4qh-tbhv | Xenstore: guests can let run xenstored out of memory |
CVE-2022-42312
XSA-326 |
| VCID-71w3-tqqz-4yf2 | Host crash due to guest VMX instruction execution |
CVE-2013-4551
|
| VCID-72xf-u3h5-zfds | ARM guests may induce host asynchronous abort |
CVE-2016-9816
|
| VCID-747z-zf92-4fbx | grant_table: possibly premature clearing of GTF_writing / GTF_reading |
CVE-2017-12855
XSA-230 |
| VCID-75hg-p8uc-p7ex | Speculative Store Bypass |
CVE-2018-3639
XSA-263 |
| VCID-76k4-hmgg-63fq | add-to-physmap error paths fail to release lock on ARM |
CVE-2017-15596
XSA-235 |
| VCID-77st-3475-5kdr | HVM soft-reset crashes toolstack |
CVE-2021-28687
XSA-368 |
| VCID-77vv-s9qz-9fft | x86: Incorrect handling of IST settings during CPU hotplug |
CVE-2017-15594
XSA-244 |
| VCID-78v1-hz5k-4beu | x86 software interrupt injection mis-handled |
CVE-2016-9377
|
| VCID-7d5b-66n7-zbe1 | x86/HVM pinned cache attributes mis-handling |
CVE-2022-42333
CVE-2022-43334 XSA-428 |
| VCID-7ek3-weqx-9fhs | x86: Multiple speculative security issues |
CVE-2022-23824
XSA-422 |
| VCID-7etc-u5ya-zued | IOMMU: RMRR (VT-d) and unity map (AMD-Vi) handling issues |
CVE-2022-26358
|
| VCID-7gba-36c6-r7em | PV superpage functionality missing sanity checks |
CVE-2016-1570
|
| VCID-7ghz-5whc-u3ee | find_next_bit() issues |
CVE-2019-19582
XSA-307 |
| VCID-7gt7-r3j9-cbb3 | A heap-based buffer overflow in QEMU could result in execution of arbitrary code. |
CVE-2015-3214
|
| VCID-7r2x-vm78-gkb3 | QEMU: Banked access to VGA memory (VBE) uses inconsistent bounds checks |
CVE-2016-3710
|
| VCID-7t5h-jy8h-t3d4 | Xenstore: Cooperating guests can create arbitrary numbers of nodes |
CVE-2022-42323
|
| VCID-7tzw-mz63-rucy | Hypervisor crash due to missing exception recovery on XRSTOR |
CVE-2013-2077
|
| VCID-7vn6-5h93-27hn | L1 Terminal Fault speculative side channel |
CVE-2018-3620
|
| VCID-7wyt-uh2c-a3ha | x86 pv: Insufficient care with non-coherent mappings |
CVE-2022-26363
|
| VCID-7ysh-usku-c3dz | x86/HVM pinned cache attributes mis-handling |
CVE-2022-42334
|
| VCID-7zpj-3par-s3b5 | Xenstore: guests can let run xenstored out of memory |
CVE-2022-42316
|
| VCID-83as-9f42-6ubf | qemu disk backend (qdisk) resource leak |
CVE-2013-4375
|
| VCID-83pg-u792-vkht | XENMEM_exchange error handling issues |
CVE-2015-8339
|
| VCID-85jp-mmaq-n7ck | x86: insufficient TLB flushing when using PCID |
CVE-2019-17346
|
| VCID-86rr-juws-eya2 | page type reference leak on x86 |
CVE-2017-15593
XSA-242 |
| VCID-87tq-2me2-d3bb | Xenstore: guests can let run xenstored out of memory |
CVE-2022-42314
|
| VCID-895c-wwg8-cbe5 | Cirrus VGA Heap overflow via display refresh |
CVE-2016-9603
XSA-211 |
| VCID-898q-dzb7-3qe7 | missing preemption in x86 PV page table unvalidation |
CVE-2019-17344
|
| VCID-8cb8-vq2c-q3e9 | Xenstore: Guests can crash xenstored |
CVE-2022-42309
XSA-414 |
| VCID-8g31-68m7-b3ak | grant table v2 -> v1 transition may crash Xen |
CVE-2018-7541
XSA-255 |
| VCID-8pkj-jwhg-3ub7 | Use after free in QEMU/Xen block unplug protocol |
CVE-2015-5166
|
| VCID-8q9q-fs5n-gyfj | Privilege escalation via emulated floppy disk drive |
CVE-2015-3456
|
| VCID-8r8y-8bq2-jufj | oxenstored: permissions not checked on root node |
CVE-2020-29479
XSA-353 |
| VCID-8tn1-kvxa-m3ex | QEMU: Banked access to VGA memory (VBE) uses inconsistent bounds checks |
CVE-2016-3712
|
| VCID-8va9-ey8c-w7hv | Mishandling of uninitialised FIFO-based event channel control blocks |
CVE-2014-6268
|
| VCID-8xdy-x7d6-43hk | Unsanitised driver domain input in libxl device handling |
CVE-2016-4963
|
| VCID-91hk-73kq-83g6 | lock order inversion in transitive grant copy handling |
CVE-2022-33748
XSA-411 |
| VCID-9df6-w2mk-37bp | arm: Host crash when preempting a multicall |
CVE-2015-7812
|
| VCID-9ed4-5mca-kfdv | x86: steal_page violates page_struct access discipline |
CVE-2019-17342
|
| VCID-9hbw-uh8q-1uex | hypercall set_debugreg vulnerability |
CVE-2012-3494
|
| VCID-9hr5-p18q-7qb8 | FIFO event channels control structure ordering |
CVE-2020-29571
XSA-359 |
| VCID-9jjd-pybt-aqcm | Hypervisor memory corruption due to x86 emulator flaw |
CVE-2015-2151
|
| VCID-9s43-gewn-bycc | grant table v2 status pages may remain accessible after de-allocation (take two) |
CVE-2021-28703
XSA-387 |
| VCID-9trf-swg1-wfb6 | possible null dereference when parsing vif ratelimiting info |
CVE-2013-4369
|
| VCID-9u79-6d2w-aqcr | Information leak through XEN_DOMCTL_gettscinfo |
CVE-2015-3340
|
| VCID-9v7z-e7bj-yff7 | Improper MSR range used for x2APIC emulation |
CVE-2014-7188
|
| VCID-9yb3-ge9b-sbe1 | VMX: guest user mode may crash guest with non-canonical RIP |
CVE-2016-2271
|
| VCID-9yut-bdsw-gkfy | Microarchitectural Data Sampling speculative side channel |
CVE-2018-12127
|
| VCID-9zqd-3x84-43gc | arm: guest_physmap_remove_page not removing the p2m mappings |
CVE-2022-23033
XSA-393 |
| VCID-a2ms-wryt-duct | x86 software interrupt injection mis-handled |
CVE-2016-9378
XSA-196 |
| VCID-a3by-shse-q3fr | multiple xenoprof issues |
CVE-2020-11740
|
| VCID-a7w3-bhxr-rqhe | qemu-dm buffer overrun in MSI-X handling |
CVE-2015-8554
|
| VCID-adh2-ubyt-xyfu | x86 PV guests may gain access to internally used pages |
CVE-2017-17566
|
| VCID-aeh3-vzax-jqfh | cirrus_bitblt_cputovideo does not check if memory region is safe |
CVE-2017-2620
XSA-209 |
| VCID-ahxj-272k-gbfs | VT-d: Failure to quarantine devices in !HVM builds |
CVE-2023-46840
XSA-450 |
| VCID-amzk-38qt-6kdn | Insufficient bounding of "REP MOVS" to MMIO emulated inside the hypervisor |
CVE-2014-8867
|
| VCID-an7r-pjrv-pyde | Fix for XSA-240 conflicts with shadow paging |
CVE-2018-19966
XSA-280 |
| VCID-anrs-qj58-p3fj | x86 null segments not always treated as unusable |
CVE-2016-9386
XSA-191 |
| VCID-as1n-dj7c-63gh | Hypervisor crash due to missing exception recovery on XSETBV |
CVE-2013-2078
|
| VCID-au4w-wt7d-37h4 | information leak in legacy x86 FPU/XMM initialization |
CVE-2015-8555
|
| VCID-aw3c-9db1-a7eh | ARM: Interrupts are unconditionally unmasked in exception handlers |
CVE-2019-18422
XSA-303 |
| VCID-awu8-fjd8-2udk | qemu SCSI REPORT LUNS buffer overflow |
CVE-2013-4344
|
| VCID-awup-6h5b-uydc | Potential unintended writes to host MSI message data field via qemu |
CVE-2015-4103
|
| VCID-az8d-xrb4-3ug4 | Another race in XENMAPSPACE_grant_table handling |
CVE-2021-28701
XSA-384 |
| VCID-b11f-3gfg-ukgd | Certain domctl operations may be abused to lock up the host |
CVE-2015-2751
|
| VCID-b7tb-ns1t-fyaw | IOMMU: RMRR (VT-d) and unity map (AMD-Vi) handling issues |
CVE-2022-26361
|
| VCID-b829-8859-cfg4 | insufficient grant unmapping checks for x86 PV guests |
CVE-2017-14319
XSA-234 |
| VCID-b8tm-tc7z-vkf8 | arm: vgic: incorrect rate limiting of guest triggered logging |
CVE-2015-1563
|
| VCID-ba9f-7cxr-v7f9 | Lock order reversal between page allocation and grant table locks |
CVE-2013-4494
|
| VCID-bc6f-wu8g-5yb4 | Xenstore: guests can disturb domain cleanup |
CVE-2020-29483
XSA-325 |
| VCID-bd46-xyhc-8uf5 | missing descriptor table limit checking in x86 PV emulation |
CVE-2019-18425
XSA-298 |
| VCID-bdx7-79cn-sud2 | integer overflow in several XSM/Flask hypercalls |
CVE-2014-1891
|
| VCID-bhws-bgg4-m3bn | PHYSDEVOP_map_pirq index vulnerability |
CVE-2012-3498
|
| VCID-bksh-c5ey-37f4 | Out-of-memory condition yielding memory corruption during IRQ setup |
CVE-2014-1642
|
| VCID-bs56-1z79-uqbt | x86 pv guest kernel DoS via SYSENTER |
CVE-2020-25596
XSA-339 |
| VCID-bt3d-7y39-8fh6 | grant table entry swaps have inadequate bounds checking |
CVE-2012-3516
|
| VCID-bxae-85uh-uyek | PoD operations on misaligned GFNs |
CVE-2021-28708
|
| VCID-bxb7-7gpw-qybb | Xenstore: guests can let run xenstored out of memory |
CVE-2022-42315
|
| VCID-bz27-8gdr-xue7 | Qemu VT100 emulation vulnerability |
CVE-2012-3515
|
| VCID-bzve-5gwu-8ydb | x86 pv: Crash when handling guest access to MSR_MISC_ENABLE |
CVE-2020-25602
XSA-333 |
| VCID-c2h3-cujg-77fp | Page reference counting error due to XSA-45/CVE-2013-1918 fixes |
CVE-2013-1432
|
| VCID-cbtr-g13y-tbhz | Unlimited Arm Atomics Operations |
CVE-2019-17349
|
| VCID-cgf9-wy2g-y3eg | Grant table version switch list corruption vulnerability |
CVE-2012-5510
|
| VCID-crrb-s8ya-kkef | x86: Mishandling of SYSCALL singlestep during emulation |
CVE-2016-10013
XSA-204 |
| VCID-csy7-esn4-u3gq | x86: MMIO Stale Data vulnerabilities |
CVE-2022-21123
|
| VCID-ctrg-1peq-vfdx | xl command line config handling stack overflow |
CVE-2015-3259
|
| VCID-cuab-yybg-6uhs | Use of v2 grant tables may cause crash on ARM |
CVE-2018-15469
XSA-268 |
| VCID-cvdk-37ua-3uck | x86 vHPET interrupt injection errors |
CVE-2018-10982
XSA-261 |
| VCID-cw5x-42j4-4yd2 | resolv.c in the DNS resolver in uIP, and dns.c in the DNS resolver in lwIP 1.4.1 and earlier, does not use random values for ID fields and source ports of DNS query packets, which makes it easier for man-in-the-middle attackers to conduct cache-poisoning attacks via spoofed reply packets. |
CVE-2014-4883
|
| VCID-cze8-zk35-z7gm | x86: missing NULL pointer check in VMFUNC emulation |
CVE-2016-10025
XSA-203 |
| VCID-d172-uby3-43ez | kernel: guest crashes on non-EPT machines may crash the host as well |
CVE-2010-2938
|
| VCID-d3ad-6tme-bfem | oxenstored: node ownership can be changed by unprivileged clients |
CVE-2020-29486
XSA-352 |
| VCID-d482-9v57-dyg3 | HVM guest destroy p2m teardown host DoS vulnerability |
CVE-2012-3433
|
| VCID-dc9p-tdf1-h7ad | x86: CPU lockup during exception delivery |
CVE-2015-5307
|
| VCID-dfjm-gwzm-jqbt | Oxenstored 32->31 bit integer truncation issues |
CVE-2022-42324
XSA-420 |
| VCID-dg8u-3vd1-27ef | arm: vgic: Out-of-bound access when sending SGIs |
CVE-2017-10923
XSA-225 |
| VCID-dgm4-ye4m-1fcq | Xenstore: Guests can get access to Xenstore nodes of deleted domains |
CVE-2022-42320
XSA-417 |
| VCID-dj1v-h79p-9ydz | Racy interactions between dirty vram tracking and paging log dirty hypercalls |
CVE-2022-26356
XSA-397 |
| VCID-dk8j-hwqd-33ek | ARM guests may induce host asynchronous abort |
CVE-2016-9818
XSA-201 |
| VCID-dqy9-zkvw-e3gk | lack of preemption in evtchn_reset() / evtchn_destroy() |
CVE-2020-25601
XSA-344 |
| VCID-drhd-ytb7-u3em | Xenstore: new domains inheriting existing node permissions |
CVE-2020-29481
XSA-322 |
| VCID-dty8-26vq-yqbq | Nested HVM exposes host to being driven out of memory by guest |
CVE-2013-0152
|
| VCID-dzsn-fpfg-vbhy | leak of main per-domain vcpu pointer array |
CVE-2015-7969
|
| VCID-e5uy-33bq-3yb3 | ARM hypervisor crash on guest interrupt controller access |
CVE-2014-2986
|
| VCID-e797-dkq8-2kfp | grant table hypercall acquire/release imbalance |
CVE-2013-1964
|
| VCID-e7fa-udtd-eugj | several HVM operations do not validate the range of their inputs |
CVE-2012-5511
|
| VCID-e96u-uwba-kfg5 | Speculative Code Store Bypass |
CVE-2021-26313
|
| VCID-eaz5-1yjy-cybd | x86: unintended memory sharing between guests |
CVE-2022-42327
XSA-412 |
| VCID-eb8v-p31a-yuhu | once valid event channels may not turn invalid |
CVE-2020-25597
XSA-338 |
| VCID-eg78-hrzm-vucz | arm: Race between domain destruction and memory allocation decrease |
CVE-2015-7814
|
| VCID-egfe-8d7p-mfaf | Multiple vulnerabilities have been found in Xen, allowing attackers on a Xen Virtual Machine to execute arbitrary code, cause Denial of Service, or gain access to data on the host. |
CVE-2012-6036
|
| VCID-eka3-u8e5-3uad | undue deferral of IOMMU TLB flushes |
CVE-2020-27671
XSA-346 |
| VCID-emjs-dbhy-nqdr | x86 software guest page walk PS bit handling flaw |
CVE-2016-4480
|
| VCID-ep7n-um5m-ekgk | PCI passthrough code reading back hardware registers |
CVE-2020-25595
XSA-337 |
| VCID-eutx-gmuf-gkeq | libxl fails to honour readonly flag on HVM emulated SCSI disks |
CVE-2018-12892
XSA-266 |
| VCID-f768-p44v-7fhk | HVM qemu unexpectedly enabling emulated VGA graphics backends |
CVE-2015-2152
|
| VCID-fafv-creg-qfbt | x86: PV guest may crash Xen with XPTI |
CVE-2018-10471
XSA-259 |
| VCID-favj-4du1-qqe8 | VCPUOP_initialise DoS |
CVE-2019-18420
|
| VCID-fe96-8s69-37fh | long running memory operations on ARM |
CVE-2015-8338
|
| VCID-fekb-fbhz-y7g7 | PoD operations on misaligned GFNs |
CVE-2021-28704
XSA-388 |
| VCID-fhbs-3nvf-tbha | Arm: unbounded memory consumption for 2nd-level page tables |
CVE-2022-33747
XSA-409 |
| VCID-fj2r-tp5w-j3dg | x86: unintentional logging upon guest changing callback method |
CVE-2015-8615
|
| VCID-fkzr-8wde-fkbk | guest administrator can access qemu monitor console |
CVE-2012-4411
|
| VCID-fqt9-2esb-ffan | PCI devices with RMRRs not deassigned correctly |
CVE-2021-28702
XSA-386 |
| VCID-fu3d-da48-y3ct | Unhooking empty PAE entries DoS vulnerability |
CVE-2012-4538
|
| VCID-fzvt-zmn5-wfb3 | grant transfer allows PV guest to elevate privileges |
CVE-2017-8904
XSA-214 |
| VCID-g39p-9sdm-tkbh | Lock order reversal between page_alloc_lock and mm_rwlock |
CVE-2013-4553
|
| VCID-g3ss-8y7t-m7ap | Guest triggerable qemu MSI-X pass-through error messages |
CVE-2015-4105
|
| VCID-g4cn-35nz-37gv | PHYSDEVOP_{prepare,release}_msix exposed to unprivileged guests |
CVE-2014-1666
|
| VCID-g72t-7kx1-abcs | xen/arm: No memory limit for dom0less domUs |
CVE-2021-28700
XSA-383 |
| VCID-g9hd-27my-6baj | x86/PV: page type reference counting issue with failed IOMMU update |
CVE-2019-17345
|
| VCID-gapz-f86h-1kdm | Intel VT-d Interrupt Remapping engines can be evaded by native NMI interrupts |
CVE-2013-3495
|
| VCID-gb8y-jxgr-5qdg | possible memory corruption via failsafe callback |
CVE-2017-8905
XSA-215 |
| VCID-gdsj-4cbx-ufep | issues with partially successful P2M updates on x86 |
CVE-2021-28705
|
| VCID-gj1u-mbaj-kyc5 | Xenstore: Guests can create orphaned Xenstore nodes |
CVE-2022-42310
XSA-415 |
| VCID-gka7-s2f9-xycf | Multiple vulnerabilities in libelf PV kernel handling |
CVE-2013-2196
|
| VCID-gnr1-nkyy-5bc5 | Information leak on AVX and/or LWP capable CPUs |
CVE-2013-1442
|
| VCID-gr1e-xzu5-1kfh | guest 32-bit ELF symbol table load leaking host data |
CVE-2016-9384
XSA-194 |
| VCID-gsas-zqvf-2khf | Incorrect error handling in event channel port allocation |
CVE-2020-15566
XSA-317 |
| VCID-gvg8-qk7q-zfhy | use-after-free in xc_cpupool_getinfo() under memory pressure |
CVE-2014-1950
|
| VCID-gyum-cdqq-nbb3 | misplaced free in ocaml xc_vcpu_getaffinity stub |
CVE-2013-4370
|
| VCID-h4hf-xbq6-n7e1 | Unsanitised guest input in libxl device handling code |
CVE-2016-4962
|
| VCID-h8w2-rzzc-qqf5 | NULL pointer deref in event channel poll |
CVE-2017-10917
XSA-221 |
| VCID-h9c6-yw5r-v3ex | infinite loop when cleaning up IRQ vectors |
CVE-2020-29567
XSA-356 |
| VCID-hg4z-ad3f-fbc2 | x86 pv: Insufficient care with non-coherent mappings |
CVE-2022-26364
XSA-402 |
| VCID-hsau-swt9-kyf7 | Xenstore: Guests can cause Xenstore to not free temporary memory |
CVE-2022-42319
XSA-416 |
| VCID-hx7j-eymk-4ygk | IOMMU: RMRR (VT-d) and unity map (AMD-Vi) handling issues |
CVE-2022-26359
|
| VCID-hyup-47wa-pfac | x86: TSX Async Abort protections not restored after S3 |
CVE-2021-28690
XSA-377 |
| VCID-j64d-px9g-qud1 | Multiple vulnerabilities have been found in Xen, allowing attackers on a Xen Virtual Machine to execute arbitrary code, cause Denial of Service, or gain access to data on the host. |
CVE-2012-6032
|
| VCID-j795-xm4x-gkc3 | HVMOP_set_mem_access is not preemptible |
CVE-2014-2599
|
| VCID-j8js-mubz-y3d3 | qemu-dm Local Privilege Escalation Vulnerability |
CVE-2012-0029
|
| VCID-j9gy-kfvu-4bat | Missing unlock in XENMEM_acquire_resource error path |
CVE-2020-25598
XSA-334 |
| VCID-j9w4-jjad-puhm | Unmediated PCI register access in qemu |
CVE-2015-4106
|
| VCID-jfmu-gcux-y3et | x86: inconsistent cachability flags on guest mappings |
CVE-2016-2270
|
| VCID-jgnb-5sdw-cuey | Hypervisor heap contents leaked to guests |
CVE-2014-4021
|
| VCID-jhnb-rufu-8ubj | Multiple vulnerabilities have been found in Xen, allowing attackers on a Xen Virtual Machine to execute arbitrary code, cause Denial of Service, or gain access to data on the host. |
CVE-2011-3262
|
| VCID-jkch-ysx6-2kd6 | cxenstored: Race in domain cleanup |
CVE-2017-14317
XSA-233 |
| VCID-jnab-uhtk-huf6 | x86: Long latency populate-on-demand operation is not preemptible |
CVE-2015-7970
|
| VCID-jwdv-qe4x-yfgw | race in VT-d domain ID cleanup |
CVE-2022-26357
XSA-399 |
| VCID-k133-xqmd-vqhr | x86: Cross-Thread Return Address Predictions |
CVE-2022-27672
XSA-426 |
| VCID-k45n-139y-pyeq | Microarchitectural Data Sampling speculative side channel |
CVE-2019-11091
|
| VCID-k5j4-3xmv-a7bk | undue recursion in x86 HVM context switch code |
CVE-2020-29566
XSA-348 |
| VCID-k6c1-7yj2-myay | Memory mapping failure DoS vulnerability |
CVE-2012-4537
|
| VCID-k8at-7tax-5ffr | hypervisor stack leak in x86 I/O intercept code |
CVE-2017-15589
XSA-239 |
| VCID-k8hr-hneg-2baf | arm: various unimplemented hypercalls log without rate limiting |
CVE-2015-7813
|
| VCID-kcj6-ua4t-ybgj | IOMMU page mapping issues on x86 |
CVE-2021-28696
|
| VCID-kf1y-ck1r-1kh8 | Bad error path in GNTTABOP_map_grant |
CVE-2020-11743
XSA-316 |
| VCID-km9e-c58c-jkbp | grant table transfer issues on large hosts |
CVE-2019-17340
|
| VCID-knqd-zktw-cydm | Speculative Code Store Bypass |
CVE-2021-0089
XSA-375 |
| VCID-krd6-2fmf-xbas | Information leaks through I/O instruction emulation |
CVE-2013-4355
|
| VCID-ksn6-6gex-17hv | x86: some pmu and profiling hypercalls log without rate limiting |
CVE-2015-7971
|
| VCID-m4fg-qcbu-m7e4 | XENMEM_populate_physmap DoS vulnerability |
CVE-2012-3496
|
| VCID-m5h4-49wd-y7b1 | libxl fails to honour readonly flag on disks with qemu-xen |
CVE-2015-7311
|
| VCID-maj1-5zy9-qyab | qemu ioport array overflow |
CVE-2016-9637
|
| VCID-mbv9-7v2m-4qf8 | page transfer may allow PV guest to elevate privilege |
CVE-2017-10912
XSA-217 |
| VCID-mcd1-vc14-y3g5 | Linear pagetable use / entry miscounts |
CVE-2019-19578
XSA-309 |
| VCID-mcs2-ndqd-tydv | x86: speculative vulnerability in 32bit SYSCALL path |
CVE-2022-42331
XSA-429 |
| VCID-mehs-bmad-pkds | x86: #DB exception safety check can be triggered by a guest |
CVE-2018-12893
XSA-265 |
| VCID-mf8g-nbkw-f7gr | grant table v2 status pages may remain accessible after de-allocation |
CVE-2021-28697
XSA-379 |
| VCID-mfdc-phyf-vyhv | Race condition in HVMOP_track_dirty_vram |
CVE-2014-7154
|
| VCID-mfss-dr4n-fbgt | xen crash due to use after free on hvm guest teardown |
CVE-2015-0361
|
| VCID-mgr6-48jn-cbeg | Unrestricted qemu logging |
CVE-2014-3672
|
| VCID-mjsu-m9mt-ukdx | Missing memory barriers in read-write unlock paths |
CVE-2020-11739
XSA-314 |
| VCID-mmpb-71zs-4fft | printk is not rate-limited in xenmem_add_to_physmap_one |
CVE-2015-6654
|
| VCID-mn7p-cz54-hqag | Guests can cause Xenstore crash via soft reset |
CVE-2022-42330
XSA-425 |
| VCID-mnb7-8ygk-kuhs | Multiple vulnerabilities in libelf PV kernel handling |
CVE-2013-2194
|
| VCID-mr8s-g8d8-euhb | Hypercalls exposed to privilege rings 1 and 2 of HVM guests |
CVE-2013-4554
|
| VCID-mrv7-87w6-vqdk | pirq range check DoS vulnerability |
CVE-2012-4536
|
| VCID-mspa-23bw-9be1 | delimiter injection vulnerabilities in pygrub |
CVE-2016-9380
XSA-198 |
| VCID-mtet-bdcj-tffd | Xen DoS using IOMMU faults from PCI-passthrough guest |
CVE-2011-3131
|
| VCID-n3t2-m6br-ufb3 | stack corruption from XSA-346 change |
CVE-2020-29040
XSA-355 |
| VCID-n587-f4q9-87dy | Insufficient restrictions on certain MMU update hypercalls |
CVE-2014-8594
|
| VCID-n5nt-82va-kfeb | improper x86 shadow mode refcount error handling |
CVE-2017-17564
|
| VCID-n7ds-k8b1-u3d2 | pin count / page reference race in grant table code |
CVE-2017-15597
XSA-236 |
| VCID-n7kw-fq5s-4kdh | Xen domain builder Out-of-memory due to malicious kernel/ramdisk |
CVE-2012-4544
|
| VCID-n7pg-b7kc-wkew | inappropriate x86 IOMMU timeout detection / handling |
CVE-2021-28692
XSA-373 |
| VCID-nb86-6sk5-8yas | Multiple vulnerabilities have been found in Xen, allowing attackers on a Xen Virtual Machine to execute arbitrary code, cause Denial of Service, or gain access to data on the host. |
CVE-2012-6035
|
| VCID-ndz3-372h-8fhk | FIFO event channels control block related ordering |
CVE-2020-29570
XSA-358 |
| VCID-nhj6-dhyx-xbas | x86: Machine Check Error on Page Size Change DoS |
CVE-2018-12207
XSA-304 |
| VCID-nmg3-4zaj-zbaq | preemption checks bypassed in x86 PV MM handling |
CVE-2018-12891
XSA-264 |
| VCID-ns7u-fmmr-5ba4 | TSX Asynchronous Abort speculative side channel |
CVE-2019-11135
XSA-305 |
| VCID-nvk7-bptq-5ffh | x86: insufficient reference counts during shadow emulation |
CVE-2017-10915
XSA-219 |
| VCID-nwp3-9ygr-63gp | integer overflow in several XSM/Flask hypercalls |
CVE-2014-1893
|
| VCID-nyst-ybjq-3uet | x86: Missing SMAP whitelisting in 32-bit exception / event delivery |
CVE-2016-6259
XSA-183 |
| VCID-p3jn-mvy5-gkgw | broken x86 shadow mode refcount overflow check |
CVE-2017-17563
|
| VCID-p3uc-18e9-skb4 | xenstore watch notifications lacking permission checks |
CVE-2020-29480
XSA-115 |
| VCID-p58r-1v6u-wyc5 | p2m lock starvation |
CVE-2014-9065
|
| VCID-p7ug-wwk5-63gb | out of bounds event channels available to 32-bit x86 domains |
CVE-2020-25600
XSA-342 |
| VCID-pb8n-hmsc-syfw | P2M pool freeing may take excessively long |
CVE-2022-33746
XSA-410 |
| VCID-pd4h-ra44-gyb5 | ARM guest disabling interrupt may crash Xen |
CVE-2017-10919
XSA-223 |
| VCID-pncq-kkun-buae | Multiple vulnerabilities have been found in Xen, allowing attackers on a Xen Virtual Machine to execute arbitrary code, cause Denial of Service, or gain access to data on the host. |
CVE-2012-6031
|
| VCID-pphm-ygb7-q7g2 | Xenstore: Cooperating guests can create arbitrary numbers of nodes |
CVE-2022-42322
XSA-419 |
| VCID-pqd6-dfhc-qfc3 | integer overflow in several XSM/Flask hypercalls |
CVE-2014-1894
|
| VCID-prt3-bjzf-9uca | Long latency MMIO mapping operations are not preemptible |
CVE-2015-2752
|
| VCID-pv8w-7nk4-u3eg | x86: PV kernel context switch corruption |
CVE-2019-17347
|
| VCID-pzt3-abab-4kdd | x86 PV guest INVLPG-like flushes may leave stale TLB entries |
CVE-2020-27674
XSA-286 |
| VCID-q3n8-1dzu-fkc4 | Hardware features unintentionally exposed to guests on ARM |
CVE-2014-2915
|
| VCID-q479-9fry-y7dh | x86: Privilege escalation in PV guests |
CVE-2016-6258
XSA-182 |
| VCID-qawr-2f43-4yeg | x86: infinite loop due to missing PoD error checking |
CVE-2017-17044
|
| VCID-qg9d-zmph-vufm | find_next_bit() issues |
CVE-2019-19581
|
| VCID-qmav-pppv-p3e1 | x86: mishandling of debug exceptions |
CVE-2018-8897
XSA-260 |
| VCID-qnew-xqte-kbej | Xenstore: Guests can crash xenstored via exhausting the stack |
CVE-2022-42321
XSA-418 |
| VCID-qprv-989b-k3d3 | IOMMU page mapping issues on x86 |
CVE-2021-28694
XSA-378 |
| VCID-qtbj-1dcj-ykhz | x86 HVM: Overflow of sh_ctxt->seg_reg[] |
CVE-2016-7094
XSA-187 |
| VCID-qwuf-ccyr-guav | Information leak through fbld instruction emulation |
CVE-2013-4361
|
| VCID-r1ca-najr-xuh6 | x86 shadow: Insufficient TLB flushing when using PCID |
CVE-2019-17348
XSA-294 |
| VCID-r2cx-vkhu-97fh | Missing privilege level checks in x86 emulation of software interrupts |
CVE-2014-7156
|
| VCID-r413-wp19-uuba | HVMOP_set_mem_type allows invalid P2M entries to be created |
CVE-2014-3124
|
| VCID-r5th-7nku-tkgx | Hardware timer context is not properly context switched on ARM |
CVE-2014-3125
|
| VCID-r8wr-5dem-z7db | ARM guests may induce host asynchronous abort |
CVE-2016-9817
|
| VCID-rgt3-wkaw-eqca | Information leak via side effects of speculative execution |
CVE-2017-5754
|
| VCID-rkkc-k39k-9yhn | input handling vulnerabilities loading guest kernel on ARM |
CVE-2014-3714
|
| VCID-rn1h-xy8j-uqgs | x86: Incorrect MSR_DEBUGCTL handling lets guests enable BTS |
CVE-2018-15468
XSA-269 |
| VCID-rqjg-umw7-vyfu | Bad continuation handling in GNTTABOP_copy |
CVE-2020-11742
XSA-318 |
| VCID-rtgs-1b4s-53d2 | Multiple vulnerabilities have been found in Xen, allowing attackers on a Xen Virtual Machine to execute arbitrary code, cause Denial of Service, or gain access to data on the host. |
CVE-2012-6034
|
| VCID-ruer-yx4b-gyhz | libxl allows guest write access to sensitive console related xenstore keys |
CVE-2013-2211
|
| VCID-rwqp-dwnr-2ubx | x86 PV guests may be able to mask interrupts |
CVE-2016-10024
XSA-202 |
| VCID-s1nr-a4yy-vuaw | Hypervisor crash due to incorrect ASSERT (debug build only) |
CVE-2013-0154
|
| VCID-s4nf-p69f-pue8 | inadequate grant-v2 status frames array bounds check |
CVE-2021-28699
XSA-382 |
| VCID-s74x-nvav-rud6 | VT-d (PCI passthrough) MSI trap injection |
CVE-2011-1898
|
| VCID-sj9v-4djq-ukf1 | libvchan failure handling malicious ring indexes |
CVE-2014-1896
|
| VCID-sjcb-7vtd-k3gn | Several long latency operations are not preemptible |
CVE-2013-1918
|
| VCID-skd7-zpbc-8fdj | Information leak on XSAVE/XRSTOR capable AMD CPUs |
CVE-2013-2076
|
| VCID-sm96-n11u-t7a9 | vulnerability in the iret hypercall handler |
CVE-2015-4164
|
| VCID-sqyq-m67p-z7cc | x86 PVH guest without LAPIC may DoS the host |
CVE-2018-7542
XSA-256 |
| VCID-srt6-6fge-8qbp | x86 shadow pagetables: address width overflow |
CVE-2016-3960
|
| VCID-ssq4-ktcc-pbgp | use-after-free in libxl_list_cpupool under memory pressure |
CVE-2013-4371
|
| VCID-su2v-p4ap-xqes | PV guest host Denial of Service |
CVE-2012-2934
|
| VCID-sv2q-enaa-7bfr | Vulnerabilities in HVM MSI injection |
CVE-2014-3967
|
| VCID-t14z-dxet-fyet | broken AMD FPU FIP/FDP/FOP leak workaround |
CVE-2016-3159
|
| VCID-t5uz-r29w-nueq | Information leak via crafted user-supplied CDROM |
CVE-2018-10472
XSA-258 |
| VCID-t6vx-kxne-k7bw | xen: 64-bit PV xen guest can crash host by accessing hypervisor per-domain memory area |
CVE-2010-4255
|
| VCID-t9tu-mc8k-vygc | IOMMU TLB flushing may be inadvertently suppressed |
CVE-2013-6400
|
| VCID-tagr-5fpf-4bcj | Heap overflow in QEMU PCNET controller, allowing guest->host escape |
CVE-2015-3209
|
| VCID-tb5v-mhdb-wbem | insufficient TLB flushing / improper large page mappings with AMD IOMMUs |
CVE-2018-19961
|
| VCID-tbgk-fwbt-cqa3 | qemu: ccid: buffer overflow in handling of VSC_ATR message |
CVE-2011-4111
|
| VCID-td6e-x2qb-syg3 | x86: MMIO Stale Data vulnerabilities |
CVE-2022-21125
|
| VCID-th6r-zg29-gfga | qemu-nbd format-guessing due to missing format specification |
CVE-2013-1922
|
| VCID-tstb-ymge-4bfk | information leak via gnttab_setup_table on ARM |
CVE-2014-4022
|
| VCID-tvaz-fjzc-aqe2 | ARM guests may induce host asynchronous abort |
CVE-2016-9815
|
| VCID-tvgp-a9ud-mfgt | grant_table: Race conditions with maptrack free list handling |
CVE-2017-12136
XSA-228 |
| VCID-tw9g-92x5-hkcz | Insufficient TLB flushing in VT-d (iommu) code |
CVE-2013-6375
|
| VCID-twnq-fujf-d7fs | ARM: Some memory not scrubbed at boot |
CVE-2017-17046
XSA-245 |
| VCID-u98c-tx8j-hqfp | Missing privilege level checks in x86 HLT, LGDT, LIDT, and LMSW emulation |
CVE-2014-7155
|
| VCID-u9km-qptr-hqck | Unmediated PCI command register access in qemu |
CVE-2015-2756
|
| VCID-ucny-a3xb-pfgc | hypercall physdev_get_free_pirq vulnerability |
CVE-2012-3495
|
| VCID-ud2r-db8a-hqhx | Off-by-one error in FLASK_AVC_CACHESTAT hypercall |
CVE-2014-1895
|
| VCID-umyp-nvd9-b7b9 | DMOP map/unmap missing argument checks |
CVE-2017-15591
|
| VCID-unyv-cxb5-ruga | Speculative register leakage from lazy FPU context switching |
CVE-2018-3665
XSA-267 |
| VCID-upr4-b3wq-gybu | x86: broken check in memory_exchange() permits PV guest breakout |
CVE-2017-7228
XSA-212 |
| VCID-uq3p-q3kj-f7au | x86: Mishandling of instruction pointer truncation during emulation |
CVE-2016-7093
XSA-186 |
| VCID-uq8r-gwnd-2fh1 | x86: Disallow L3 recursive pagetable for 32-bit PV guests |
CVE-2016-7092
XSA-185 |
| VCID-uqsf-872r-a3dc | Memory accessible by 64-bit PV guests under live migration |
CVE-2013-4356
|
| VCID-us1d-sdm8-sbh6 | paravirtualized drivers incautious about shared memory contents |
CVE-2015-8550
|
| VCID-uunr-69dt-q7fn | long running loops in grant table handling |
CVE-2021-28698
XSA-380 |
| VCID-uvcp-ad38-2kcs | Xenstore: wrong path length check |
CVE-2020-29482
XSA-323 |
| VCID-uwu2-a6u1-uqb8 | Missing check for grant table |
CVE-2017-14318
XSA-232 |
| VCID-uyct-zk7n-sbcz | QEMU heap overflow flaw while processing certain ATAPI commands. |
CVE-2015-5154
|
| VCID-v17d-ecc6-97au | multiple xenoprof issues |
CVE-2020-11741
|
| VCID-v25t-h3tp-nffb | broken AMD FPU FIP/FDP/FOP leak workaround |
CVE-2016-3158
|
| VCID-v516-ebvk-zfap | Multiple vulnerabilities have been found in Xen, allowing attackers on a Xen Virtual Machine to execute arbitrary code, cause Denial of Service, or gain access to data on the host. |
CVE-2012-6033
|
| VCID-v8fp-rzfq-e3bs | Information leak via side effects of speculative execution |
CVE-2017-5715
|
| VCID-vb2u-yc2z-ayh5 | Missing memory barriers when accessing/allocating an event channel |
CVE-2020-25603
XSA-340 |
| VCID-vcb4-ne2n-83hx | HVMOP_get_mem_access crash / HVMOP_set_mem_access information leak |
CVE-2012-5512
|
| VCID-veqg-epht-cuaz | insufficient TLB flushing / improper large page mappings with AMD IOMMUs |
CVE-2018-19962
XSA-275 |
| VCID-vh89-pyaz-xbdg | Microarchitectural Data Sampling speculative side channel |
CVE-2018-12126
XSA-297 |
| VCID-vh8t-w89y-bbd8 | Missing NUMA node parameter verification |
CVE-2017-14316
XSA-231 |
| VCID-vj48-rcw7-vuac | HVM guest user mode MMIO emulation DoS vulnerability |
CVE-2012-3432
|
| VCID-vk8y-325p-1fed | Flaws in handling traps from 32-bit userspace on 64-bit ARM |
CVE-2014-5147
|
| VCID-vm3z-k775-gqax | Unlimited recursion in linear pagetable de-typing |
CVE-2017-15595
XSA-240 |
| VCID-vmj3-kufn-skcw | several hypercalls do not validate input GFNs |
CVE-2012-5525
|
| VCID-vq33-jrrb-7kgk | Grant table hypercall infinite loop DoS vulnerability |
CVE-2012-4539
|
| VCID-vs9k-akwv-h3ak | A PV guest could DoS Xen while unmapping a grant |
CVE-2022-23034
XSA-394 |
| VCID-vxpg-dudv-kkf5 | Host crash due to failure to correctly validate PV kernel execution state |
CVE-2011-1166
|
| VCID-w2ch-guy5-6ye9 | Insufficient cleanup of passed-through device IRQs |
CVE-2022-23035
XSA-395 |
| VCID-w7xh-bzwe-pqah | arm: vgic-v2: GICD_SGIR is not properly emulated |
CVE-2015-0268
|
| VCID-w8z5-k8fb-jbc7 | use after free in FIFO event channel code |
CVE-2016-7154
|
| VCID-wc2m-xbsh-xkb9 | kernel: xen: x86_emulate: fix SAHF emulation |
CVE-2011-2519
|
| VCID-werg-d7s2-kfbw | x86: DoS from attempting to use INVPCID with a non-canonical addresses |
CVE-2018-19965
XSA-279 |
| VCID-wgmf-2zuh-z3fn | Xen <= 3.3 DoS due to incorrect virtual address validation |
CVE-2011-2901
|
| VCID-wh75-sc4f-qqc1 | Xenstore: Guests can create arbitrary number of nodes via transactions |
CVE-2022-42325
XSA-421 |
| VCID-what-pe1h-gfa7 | Races in the grant table unmap code |
CVE-2017-10914
XSA-218 |
| VCID-wjcc-bpcz-a3ee | x86: Incorrect handling of self-linear shadow mappings with translated guests |
CVE-2017-15592
XSA-243 |
| VCID-wkvy-3mr1-uuar | input handling vulnerabilities loading guest kernel on ARM |
CVE-2014-3716
|
| VCID-wq5x-ptkj-cyaz | Mishandling of guest SSBD selection on AMD hardware |
CVE-2022-42336
XSA-431 |
| VCID-wqv9-j35n-aqen | add-to-physmap can be abused to DoS Arm hosts |
CVE-2019-18423
XSA-301 |
| VCID-wumz-ff2x-dkg4 | Long latency virtual-mmu operations are not preemptible |
CVE-2014-5149
|
| VCID-wvar-kt63-dkd5 | inverted code paths in x86 dirty VRAM tracking |
CVE-2020-15563
XSA-319 |
| VCID-wx6w-6y5m-fugn | Use after free of paging structures in EPT |
CVE-2026-23554
XSA-480 |
| VCID-x6ks-k1hc-27du | DoS via non-preemptable L3/L4 pagetable freeing |
CVE-2018-7540
XSA-252 |
| VCID-xa1k-c5dm-97am | CR0.TS and CR0.EM not always honored for x86 HVM guests |
CVE-2016-7777
XSA-190 |
| VCID-xcvw-eex8-j3bf | PoD operations on misaligned GFNs |
CVE-2021-28707
|
| VCID-xe4j-gg7f-wyfa | races with evtchn_reset() |
CVE-2020-25599
XSA-343 |
| VCID-xef9-czpm-y7e7 | multiple problems with transitive grants |
CVE-2017-12135
XSA-226 |
| VCID-xet6-w2vq-67eq | Missing alignment check in VCPUOP_register_vcpu_info |
CVE-2020-15564
XSA-327 |
| VCID-xg2s-vp8y-uuhb | x86: 64bit PV guest breakout via pagetable use-after-mode-change |
CVE-2017-8903
XSA-213 |
| VCID-xp27-f4kp-wqbm | Buffer overflow in xencontrol Python bindings affecting xend |
CVE-2013-2072
|
| VCID-xq5m-5tdr-2bbk | VT-d interrupt remapping source validation flaw for bridges |
CVE-2013-1952
|
| VCID-xubx-wxc9-tfay | x86: Nested VT-x usable even when disabled |
CVE-2018-18883
XSA-278 |
| VCID-y1bk-hyme-uyek | Long latency virtual-mmu operations are not preemptible |
CVE-2014-5146
|
| VCID-y22w-wqt3-sues | x86 CMPXCHG8B emulation fails to ignore operand size override |
CVE-2016-9932
XSA-200 |
| VCID-y2vk-6vpy-vqdj | Flaw in handling unknown system register access from 64-bit userspace on ARM |
CVE-2014-5148
|
| VCID-y3su-hg5m-g7hq | VT-d interrupt remapping source validation flaw |
CVE-2012-5634
|
| VCID-y53n-bh1t-guhh | Excessive time to disable caching with HVM guests with PCI passthrough |
CVE-2013-2212
|
| VCID-ya58-78es-d7bn | qemu incautious about shared ring processing |
CVE-2016-9381
XSA-197 |
| VCID-yaee-q1df-aqgm | x86: memory leak with MSR emulation |
CVE-2018-5244
XSA-253 |
| VCID-yahm-s7bt-akg6 | x86: PKRU and BND* leakage between vCPU-s |
CVE-2017-10916
XSA-220 |
| VCID-ycv1-t5bt-zqhj | x86: PV privilege escalation via map_grant_ref |
CVE-2017-12137
XSA-227 |
| VCID-ycvg-1w73-aqdj | integer overflow in several XSM/Flask hypercalls |
CVE-2014-1892
|
| VCID-yh4r-yysd-1ua5 | oxenstored does not apply quota-maxentity |
CVE-2018-15470
XSA-272 |
| VCID-yj2s-b6c9-27be | x86 task switch to VM86 mode mis-handled |
CVE-2016-9382
XSA-192 |
| VCID-yzmc-turm-ffds | GNTTABOP_swap_grant_ref operation misbehavior |
CVE-2015-4163
|
| VCID-z3g4-1vhq-97dj | Xenstore: Guests can create arbitrary number of nodes via transactions |
CVE-2022-42326
|
| VCID-z3qj-cnxq-pkgq | guests may exceed their designated memory limit |
CVE-2021-28706
XSA-385 |
| VCID-z537-r2vm-q3b7 | guest denial of service on syscall/sysenter exception generation |
CVE-2012-0218
|
| VCID-z61v-ubkc-dbdt | QEMU leak of uninitialized heap memory in rtl8139 device model |
CVE-2015-5165
|
| VCID-z8uz-rfbs-dygu | interrupt remap entries shared and old ones not cleared on AMD IOMMUs |
CVE-2013-0153
|
| VCID-z8zf-cqkb-guge | IOMMU: RMRR (VT-d) and unity map (AMD-Vi) handling issues |
CVE-2022-26360
XSA-400 |
| VCID-z9r8-s6v7-zkgd | Microarchitectural Data Sampling speculative side channel |
CVE-2018-12130
|
| VCID-zcna-d2sr-97dk | Information leak through outs instruction emulation |
CVE-2013-4368
|
| VCID-zh3b-cxzx-abc6 | race with pass-through device hotplug |
CVE-2019-17341
|
| VCID-zkyv-h5at-xkgq | Retbleed - arbitrary speculative code execution with return instructions |
CVE-2022-23825
XSA-407 |
| VCID-zm6z-2dnk-hyf8 | VMX: VMentry failure with debug exceptions and blocked states |
CVE-2019-19583
XSA-308 |
| VCID-zmns-hhw6-wkar | qemu (e1000 device driver): Buffer overflow when processing large packets |
CVE-2012-6075
|
| VCID-zneg-pw5s-abhy | grant table operations mishandle reference counts |
CVE-2017-10922
|
| VCID-znwm-cjxt-tqhe | Missing privilege level checks in x86 emulation of far branches |
CVE-2014-8595
|
| VCID-zrxf-3w1d-t3ba | Information leak via power sidechannel |
CVE-2020-28368
XSA-351 |