Vulnerabilities > XEN > Medium

DATE CVE VULNERABILITY TITLE RISK
2012-12-13 CVE-2011-3131 Resource Management Errors vulnerability in XEN
Xen 4.1.1 and earlier allows local guest OS kernels with control of a PCI[E] device to cause a denial of service (CPU consumption and host hang) via many crafted DMA requests that are denied by the IOMMU, which triggers a livelock.
local
low complexity
xen CWE-399
4.6
2012-11-24 CVE-2012-4538 Improper Input Validation vulnerability in XEN 4.0.0/4.1.0/4.2.0
The HVMOP_pagetable_dying hypercall in Xen 4.0, 4.1, and 4.2 does not properly check the pagetable state when running on shadow pagetables, which allows a local HVM guest OS to cause a denial of service (hypervisor crash) via unspecified vectors.
local
low complexity
xen CWE-20
4.9
2012-11-24 CVE-2012-3433 Resource Management Errors vulnerability in XEN 4.0.0/4.1.0
Xen 4.0 and 4.1 allows local HVM guest OS kernels to cause a denial of service (domain 0 VCPU hang and kernel panic) by modifying the physical address space in a way that triggers excessive shared page search time during the p2m teardown.
local
low complexity
xen CWE-399
4.9
2012-11-23 CVE-2012-6036 Permissions, Privileges, and Access Controls vulnerability in XEN 4.0.0/4.1.0/4.2.0
The (1) memc_save_get_next_page, (2) tmemc_restore_put_page and (3) tmemc_restore_flush_page functions in the Transcendent Memory (TMEM) in Xen 4.0, 4.1, and 4.2 do not check for negative id pools, which allows local guest OS users to cause a denial of service (memory corruption and host crash) or possibly execute arbitrary code via unspecified vectors.
local
xen CWE-264
4.4
2012-11-23 CVE-2012-6035 Improper Input Validation vulnerability in XEN 4.0.0/4.1.0/4.2.0
The do_tmem_destroy_pool function in the Transcendent Memory (TMEM) in Xen 4.0, 4.1, and 4.2 does not properly validate pool ids, which allows local guest OS users to cause a denial of service (memory corruption and host crash) or execute arbitrary code via unspecified vectors.
local
xen CWE-20
6.9
2012-11-23 CVE-2012-6034 Improper Input Validation vulnerability in XEN 4.0.0/4.1.0/4.2.0
The (1) tmemc_save_get_next_page and (2) tmemc_save_get_next_inv functions and the (3) TMEMC_SAVE_GET_POOL_UUID sub-operation in the Transcendent Memory (TMEM) in Xen 4.0, 4.1, and 4.2 "do not check incoming guest output buffer pointers," which allows local guest OS users to cause a denial of service (memory corruption and host crash) or execute arbitrary code via unspecified vectors.
local
xen CWE-20
4.4
2012-11-23 CVE-2012-6033 Permissions, Privileges, and Access Controls vulnerability in XEN 4.0.0/4.1.0/4.2.0
The do_tmem_control function in the Transcendent Memory (TMEM) in Xen 4.0, 4.1, and 4.2 does not properly check privileges, which allows local guest OS users to access control stack operations via unspecified vectors.
local
xen CWE-264
4.4
2012-11-23 CVE-2012-6032 Numeric Errors vulnerability in XEN 4.0.0/4.1.0/4.2.0
Multiple integer overflows in the (1) tmh_copy_from_client and (2) tmh_copy_to_client functions in the Transcendent Memory (TMEM) in Xen 4.0, 4.1, and 4.2 allow local guest OS users to cause a denial of service (memory corruption and host crash) via unspecified vectors.
local
low complexity
xen CWE-189
4.9
2012-11-23 CVE-2012-6031 Improper Input Validation vulnerability in XEN 4.0.0/4.1.0/4.2.0
The do_tmem_get function in the Transcendent Memory (TMEM) in Xen 4.0, 4.1, and 4.2 allow local guest OS users to cause a denial of service (CPU hang and host crash) via unspecified vectors related to a spinlock being held in the "bad_copy error path." NOTE: this issue was originally published as part of CVE-2012-3497, which was too general; CVE-2012-3497 has been SPLIT into this ID and others.
local
xen CWE-20
4.7
2012-11-23 CVE-2012-3516 Permissions, Privileges, and Access Controls vulnerability in multiple products
The GNTTABOP_swap_grant_ref sub-operation in the grant table hypercall in Xen 4.2 and Citrix XenServer 6.0.2 allows local guest kernels or administrators to cause a denial of service (host crash) and possibly gain privileges via a crafted grant reference that triggers a write to an arbitrary hypervisor memory location.
6.9