CVE-2024-2201: falha de média gravidade em Xen
CVE-2024-2201
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 4.7epss 8.8%
A cross-privilege Spectre v2 vulnerability allows attackers to bypass all deployed mitigations, including the recent Fine(IBT), and to leak arbitrary Linux kernel memory on Intel systems.
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Produtos afetados
Xen · XenCVEs relacionadas — Xen
No mesmo produto, das mais perigosas para as menos.
CVE-2024-31142HIGHx86: Incorrect logic for BTC/SRSO mitigationsEPSS 17.4%CVE-2023-46842MEDIUMx86 HVM hypercalls may trigger Xen bug checkEPSS 8.5%CVE-2024-2193MEDIUMSpeculative Race Condition impacts modern CPU architectures that support speculative execution, also known as GhostRace.EPSS 1.3%CVE-2025-1713HIGHdeadlock potential with VT-d and legacy PCI device pass-throughEPSS 0.9%CVE-2023-46839MEDIUMpci: phantom functions assigned to incorrect contextsEPSS 0.8%CVE-2025-27465MEDIUMx86: Incorrect stubs exception handling for flags recoveryEPSS 0.7%
Referências
https://github.com/vusec/inspectre-gadget?tab=readme-ov-filehttps://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6QKNCPX7CJUK4I6BRGABAUQK2DMQZUCA/https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/D5OK6MH75S7YWD34EWW7QIZTS627RIE3/https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RYAZ7P6YFJ2E3FHKAGIKHWS46KYMMTZH/https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/advisory-guidance/branch-history-injection.htmhttps://www.kb.cert.org/vuls/id/155143http://www.openwall.com/lists/oss-security/2024/04/09/15http://www.openwall.com/lists/oss-security/2024/05/07/7http://xenbits.xen.org/xsa/advisory-456.html