Input validation error in Xen - CVE-2013-2194
Published: August 23, 2013 / Updated: August 4, 2020
Vulnerability identifier: #VU33878
CSH Severity: High
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2013-2194
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.
Multiple integer overflows in the Elf parser (libelf) in Xen 4.2.x and earlier allow local guest administrators with certain permissions to have an unspecified impact via a crafted kernel.
Affected software
Xen
Gentoo Linux
SUSE Linux
xen (Alpine package)
app-emulation/xen
app-emulation/xen-pvgrub
app-emulation/xen-tools
Gentoo Linux
SUSE Linux
xen (Alpine package)
app-emulation/xen
app-emulation/xen-pvgrub
app-emulation/xen-tools
How to mitigate CVE-2013-2194
Install update from vendor's website.
xen (Alpine package) - update to 4.1.4-r5
app-emulation/xen - update to 4.2.2-r1
app-emulation/xen-pvgrub - update to 4.2.2-r1
app-emulation/xen-tools - update to 4.2.2-r3
app-emulation/xen - update to 4.2.2-r1
app-emulation/xen-pvgrub - update to 4.2.2-r1
app-emulation/xen-tools - update to 4.2.2-r3
External References
- http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00015.html
- http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00021.html
- http://lists.opensuse.org/opensuse-security-announce/2014-04/msg00000.html
- http://secunia.com/advisories/55082
- http://security.gentoo.org/glsa/glsa-201309-24.xml
- http://support.citrix.com/article/CTX138058
- http://www.debian.org/security/2014/dsa-3006
- http://www.openwall.com/lists/oss-security/2013/06/20/2
- http://www.openwall.com/lists/oss-security/2013/06/20/4