xend in Xen 3.0.3 does not properly limit the contents of the /local/domain xenstore…
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Complete · Complete · Complete
- Fix status
- Fixed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-264.
Summary
xend in Xen 3.0.3 does not properly limit the contents of the /local/domain xenstore directory tree, and does not properly restrict a guest VM's write access within this tree, which allows guest OS users to cause a denial of service and possibly have unspecified other impact by writing to (1) console/tty, (2) console/limit, or (3) image/device-model-pid. NOTE: this issue was originally reported as an issue in libvirt 0.3.3 and xenstore, but CVE is considering the core issue to be related to Xen.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
Remediation
Red Hat 1 advisory
- RHSA-2009:0003 Released 2009-01-07 · Red Hat rating Moderatexen security and bug fix update
- Red Hat Enterprise Linux (v. 5 server) xen-3.0.3-64.el5_2.9, xen-libs-3.0.3-64.el5_2.9, xen-libs-3.0.3-64.el5_2.9.i386 +1
- Red Hat Enterprise Linux Desktop (v. 5 client) xen-3.0.3-64.el5_2.9, xen-libs-3.0.3-64.el5_2.9, xen-libs-3.0.3-64.el5_2.9.i386
- Red Hat Enterprise Linux Desktop Multi OS (v. 5 client) xen-3.0.3-64.el5_2.9, xen-3.0.3-64.el5_2.9.i386, xen-devel-3.0.3-64.el5_2.9 +1
- Red Hat Enterprise Linux Virtualization (v. 5 server) xen-3.0.3-64.el5_2.9, xen-3.0.3-64.el5_2.9.i386, xen-3.0.3-64.el5_2.9.ia64 +3
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux (v. 5 server) | Fixed | RHSA-2009:0003 |
| Red Hat Enterprise Linux Desktop (v. 5 client) | Fixed | RHSA-2009:0003 |
| Red Hat Enterprise Linux Desktop Multi OS (v. 5 client) | Fixed | RHSA-2009:0003 |
| Red Hat Enterprise Linux Virtualization (v. 5 server) | Fixed | RHSA-2009:0003 |
Timeline
- 2026-10-02 Threatist record created from CVE-2008-4405
- 2026-10-03 Alias added: GHSA-ffpp-v4vp-9vvh
References
Other 8
- ADV-2008-2709
- https://bugzilla.redhat.com/show_bug.cgi?id=464817
- [xen-devel] 20080930 [PATCH] [Xend] Move some backend configuration
- [oss-security] 20080930 CVE Request (xen)
- [xen-devel] 20080930 Re: [PATCH] [Xend] Move some backend configuration
- oval:org.mitre.oval:def:10627
- [oss-security] 20081004 Re: CVE Request (xen)
- https://bugzilla.redhat.com/show_bug.cgi?id=464818
More Citrix Xen vulnerabilities
- TI-2011-01674 Xen 4.1 before 4.1.1 and 4.0 before 4.0.2, when using PCI passthrough on Intel VT-d… CVSS 2.0HIGH 7.4
- TI-2011-01402 Multiple integer overflows in tools/libxc/xc_dom_bzimageloader.c in Xen 3.2, 3.3, 4.0… CVSS 2.0MEDIUM 6.9
- TI-2008-05424 xend in Xen 3.3.0 does not properly restrict a guest VM's write access within the… CVSS 2.0HIGH 7.2
- TI-2010-04004 The fixup_page_fault function in arch/x86/traps.c in Xen 4.0.1 and earlier on 64-bit… CVSS 2.0MEDIUM 6.1
- TI-2010-03988 The vbd_create function in Xen 3.1.2, when the Linux kernel 2.6.18 on Red Hat Enterprise… CVSS 2.0MEDIUM 5.5
- TI-2010-03996 The do_block_io_op function in (1) drivers/xen/blkback/blkback.c and (2)… CVSS 2.0MEDIUM 5.5
Sources
- CVE-2008-4405 · CVE Program
- CVE-2008-4405 · NVD
- FIRST EPSS
- GHSA-ffpp-v4vp-9vvh · GitHub Advisory Database · CC BY 4.0
- CVE-2008-4405 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences