Vulnerabilidades em Xen

153 resultados
Análise Vexday

O hipervisor Xen acumula 111 CVEs catalogadas, com três classificadas como críticas e nenhuma atualmente registrada no catálogo CISA KEV, situando-o abaixo da média geral de exploração ativa do catálogo. A ausência de provas de conceito públicas contribui para um perfil de risco operacional contido no momento, embora o surgimento de 6 vulnerabilidades nos últimos 90 dias indique atividade contínua de descoberta que merece acompanhamento. A falha mais comum é CWE-770 (alocação de recursos sem limites adequados), padrão que em ambientes de virtualização pode ser explorado para esgotamento de recursos e impacto sobre múltiplos guests. A CVE mais perigosa atualmente rastreada é CVE-2024-31142, com escore EPSS de 0,1744, o que sugere probabilidade de exploração não desprezível e deve orientar a priorização de correções em ambientes que executam cargas de trabalho sensíveis sobre Xen.

CVE-2022-26359—IOMMU: RMRR (VT-d) and unity map (AMD-Vi) handling issues T[his CNA information record relates to multiple CVEs; the text explains which aspEPSS 0.4%CVE-2026-42488HIGHx86: mismatched mapcache metadataEPSS 0.4%CVE-2021-28708—PoD operations on misaligned GFNs T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities corEPSS 0.4%CVE-2021-28704—PoD operations on misaligned GFNs T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities corEPSS 0.4%CVE-2021-28699—inadequate grant-v2 status frames array bounds check The v2 grant table interface separates grant attributes from grant status. That is, wheEPSS 0.4%CVE-2022-23035—Insufficient cleanup of passed-through device IRQs The management of IRQs associated with physical devices exposed to x86 HVM guests involveEPSS 0.4%CVE-2021-28698—long running loops in grant table handling In order to properly monitor resource use, Xen maintains information on the grant mappings a domaEPSS 0.3%CVE-2022-23033—arm: guest_physmap_remove_page not removing the p2m mappings The functions to remove one or more entries from a guest p2m pagetable on Arm (EPSS 0.3%CVE-2022-33742—Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities cEPSS 0.3%CVE-2022-23034—A PV guest could DoS Xen while unmapping a grant To address XSA-380, reference counting was introduced for grant mappings for the case whereEPSS 0.3%CVE-2026-79608CRITICALx86/AMD: ineffectual Zenbleed workaroundEPSS 0.3%CVE-2022-33740—Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities cEPSS 0.3%CVE-2022-33741—Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities cEPSS 0.3%CVE-2022-26365—Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities cEPSS 0.3%CVE-2021-28693—xen/arm: Boot modules are not scrubbed The bootloader will load boot modules (e.g. kernel, initramfs...) in a temporary area before they areEPSS 0.3%CVE-2021-28687—HVM soft-reset crashes toolstack libxl requires all data structures passed across its public interface to be initialized before use and dispEPSS 0.3%CVE-2022-42323—Xenstore: Cooperating guests can create arbitrary numbers of nodes T[his CNA information record relates to multiple CVEs; the text explains EPSS 0.3%CVE-2022-42322—Xenstore: Cooperating guests can create arbitrary numbers of nodes T[his CNA information record relates to multiple CVEs; the text explains EPSS 0.3%CVE-2022-42325—Xenstore: Guests can create arbitrary number of nodes via transactions T[his CNA information record relates to multiple CVEs; the text explaEPSS 0.3%CVE-2022-42326MEDIUMXenstore: Guests can create arbitrary number of nodes via transactions T[his CNA information record relates to multiple CVEs; the text explaEPSS 0.3%