Input validation error in Xen - CVE-2013-4551
Published: November 18, 2013 / Updated: August 10, 2020
Vulnerability identifier: #VU42364
CSH Severity: Medium
CVSS v4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2013-4551
CWE-ID: CWE-20
Exploitation vector: Adjecent network
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.
Xen 4.2.x and 4.3.x, when nested virtualization is disabled, does not properly check the emulation paths for (1) VMLAUNCH and (2) VMRESUME, which allows local HVM guest users to cause a denial of service (host crash) via unspecified vectors related to "guest VMX instruction execution."
Affected software
Xen
How to mitigate CVE-2013-4551
Install update from vendor's website.
External References
- http://lists.opensuse.org/opensuse-updates/2013-12/msg00059.html
- http://secunia.com/advisories/55398
- http://security.gentoo.org/glsa/glsa-201407-03.xml
- http://www.openwall.com/lists/oss-security/2013/11/11/1
- http://www.securityfocus.com/bid/63625
- http://www.securitytracker.com/id/1029313
- https://exchange.xforce.ibmcloud.com/vulnerabilities/88649