Vulnerabilities

[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] A common access pattern is a batch of Grant Copy operations acting on adjacent address rang…

[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] A common access pattern is a batch of Grant Copy operations acting on adjacent address rang…

With its original introduction, GNTTAB_cache_flush was made available uniformly.

[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] 1) XSA-437 (CVE-2023-34321) addressed issues with overflows in calculations involved in gue…

[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] 1) XSA-437 (CVE-2023-34321) addressed issues with overflows in calculations involved in gue…

For XSA-308 logic was introduced, as VMX VMEntry checks do not like the exact combination of state which occurs when #DB in intercepted, Single Stepping is active, and blocked by STI/MovSS is active, despite this being a…

XSA-501 was about issues with v1 -> v2 and v2 -> v1 changes racing certain other grant table operations.

XPTI (Xen Page Table Isolation) was introduced to mitigate Meltdown (CVE-2017-5754, one aspect of XSA-254).

The workaround for XSA-433 (Zenbleed, CVE-2023-20593) was later re-worked to better integrate with other manipulations of the same MSR.

During Xenstore live update the state record for a Xenstore watch with specified watch depth is written with two bytes missing.

x86 PV guests can free memory pages while still keeping a stale TLB entry pointing to them.

A guest with a PCI device assigned that has at least a BAR on the IO port space can trigger a BUG() in Xen.

When guests are terminated, various pieces of cleanup need carrying out.

A guest started with Populated on Demand enabled (PoD) can attempt to reclaim pages which aren't regular guest RAM.

Parts of the DM_OP handling code assumes the caller has provided the required number of buffers for the given operation without any checking being done.

The EVTCHNOP_expand_array hypercall checks for whether FIFO event channels are enabled, but without holding the correct lock.

The logic to handle periodic Viridian STIMERs performs a division with an unchecked user-controlled divisor value, that can be set to zero to cause a #DE fault.

Accesses to the CMOS memory contents are done using an indirect IO port pair.

Accessing the vNUMA configuration data of a guest is still possible when domain destruction has already started.

[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] With the introduction of Grant Table v2 came the requirement to be able to switch between v…

[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] With the introduction of Grant Table v2 came the requirement to be able to switch between v…

When grant-copy operations are processed, the respective grant may or may not already be in use by another operation (a mapping or another copy).

[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] To manage the system, sysctl and platform operations are used by the control domain or a po…

[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] To manage the system, sysctl and platform operations are used by the control domain or a po…

[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The directory and Rock Ridge / SUSP walk in libfsimage's iso9660 driver derives several len…