Multiple vulnerabilities in Xen

Published: 2016-02-19 | Updated: 2020-08-09

Risk	Medium
Patch available	NO
Number of vulnerabilities	2
CVE-ID	CVE-2016-4963 CVE-2016-2271
CWE-ID	CWE-284 CWE-20
Exploitation vector	Local
Public exploit	N/A
Vulnerable software	Xen Server applications / Virtualization software
Vendor	Xen Project

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Improper access control

EUVDB-ID: #VU40248

Risk: Low

CVSSv4.0: 1.9 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2016-4963

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

Description

The vulnerability allows a local authenticated user to perform a denial of service (DoS) attack.

The libxl device-handling in Xen through 4.6.x allows local guest OS users with access to the driver domain to cause a denial of service (management tool confusion) by manipulating information in the backend directories in xenstore.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Xen: 4.0.0 - 4.6.1

CPE2.3

External links

https://www.securitytracker.com/id/1036024
https://xenbits.xen.org/xsa/advisory-178.html
https://lists.debian.org/debian-lts-announce/2018/09/msg00006.html

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Input validation error

EUVDB-ID: #VU40478

Risk: Medium

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2016-2271

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows local HVM guest users to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can cause a denial of service (guest crash) via vectors related to a non-canonical RIP.