SB2016122214 - Fedora 24 update for xen

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2016122214

SB2016122214 - Fedora 24 update for xen

Published: December 22, 2016 Updated: April 24, 2025

Security Bulletin ID SB2016122214
Severity
Low
Patch available
YES
Number of vulnerabilities 3
Exploitation vector Local access
Highest impact Code execution

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 secuirty vulnerabilities.


1) Input validation error (CVE-ID: CVE-2016-10024)

The vulnerability allows a local privileged user to a crash the entire system.

Xen through 4.8.x allows local x86 PV guest OS kernel administrators to cause a denial of service (host hang or crash) by modifying the instruction stream asynchronously while performing certain kernel operations.


2) NULL pointer dereference (CVE-ID: CVE-2016-10025)

The vulnerability allows a local authenticated user to perform a denial of service (DoS) attack.

VMFUNC emulation in Xen 4.6.x through 4.8.x on x86 systems using AMD virtualization extensions (aka SVM) allows local HVM guest OS users to cause a denial of service (hypervisor crash) by leveraging a missing NULL pointer check.


3) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2016-10013)

The vulnerability allows a local authenticated user to execute arbitrary code.

Xen through 4.8.x allows local 64-bit x86 HVM guest OS users to gain privileges by leveraging mishandling of SYSCALL singlestep during emulation.


Remediation

Install update from vendor's website.

References