Vulnerabilities in Xen
153 resultsCVE-2022-42309—Xenstore: Guests can crash xenstored Due to a bug in the fix of XSA-115 a malicious guest can cause xenstored to use a wrong pointer during EPSS 0.3%CVE-2024-45819MEDIUMlibxl leaks data to PVH guests via ACPI tablesEPSS 0.3%CVE-2022-33745—insufficient TLB flush for x86 PV guests in shadow mode For migration as well as to work around kernels unaware of L1TF (see XSA-273), PV guEPSS 0.3%CVE-2022-42321—Xenstore: Guests can crash xenstored via exhausting the stack Xenstored is using recursion for some Xenstore operations (e.g. for deleting aEPSS 0.3%CVE-2022-42320—Xenstore: Guests can get access to Xenstore nodes of deleted domains Access rights of Xenstore nodes are per domid. When a domain is gone, tEPSS 0.3%CVE-2022-42319—Xenstore: Guests can cause Xenstore to not free temporary memory When working on a request of a guest, xenstored might need to allocate quitEPSS 0.3%CVE-2022-42324—Oxenstored 32->31 bit integer truncation issues Integers in Ocaml are 63 or 31 bits of signed precision. The Ocaml Xenbus library takes a C EPSS 0.3%CVE-2022-33746—P2M pool freeing may take excessively long The P2M pool backing second level address translation for guests may be of significant size. TherEPSS 0.3%CVE-2026-102702HIGHArm: multiple issues with GNTTABOP_cache_flushEPSS 0.3%CVE-2026-102699HIGHArm: multiple issues with GNTTABOP_cache_flushEPSS 0.3%CVE-2022-42310—Xenstore: Guests can create orphaned Xenstore nodes By creating multiple nodes inside a transaction resulting in an error, a malicious guestEPSS 0.3%CVE-2021-28692—inappropriate x86 IOMMU timeout detection / handling IOMMUs process commands issued to them in parallel with the operation of the CPU(s) issEPSS 0.3%CVE-2022-33747—Arm: unbounded memory consumption for 2nd-level page tables Certain actions require e.g. removing pages from a guest's P2M (Physical-to-MachEPSS 0.3%CVE-2021-28710—certain VT-d IOMMUs may not work in shared page table mode For efficiency reasons, address translation control structures (page tables) may EPSS 0.3%CVE-2023-46835MEDIUMx86/AMD: mismatch in IOMMU quarantine page table levelsEPSS 0.3%CVE-2022-42331—x86: speculative vulnerability in 32bit SYSCALL path Due to an oversight in the very original Spectre/Meltdown security work (XSA-254), one EPSS 0.3%CVE-2023-34326HIGHx86/AMD: missing IOMMU TLB flushingEPSS 0.3%CVE-2022-33748—lock order inversion in transitive grant copy handling As part of XSA-226 a missing cleanup call was inserted on an error handling path. WhiEPSS 0.3%CVE-2024-45818MEDIUMDeadlock in x86 HVM standard VGA handlingEPSS 0.3%CVE-2022-42332—x86 shadow plus log-dirty mode use-after-free In environments where host assisted address translation is necessary but Hardware Assisted PagEPSS 0.3%