Unscored severity · published Oct 3, 2008
CVE-2008-4405
xend in Xen 3.0.3 does not properly limit the contents of the /local/domain xenstore directory tree, and does not properly restrict a guest VM's write access within this tree,…
–
CVSS
1%
EPSS
No
On KEV
Description
xend in Xen 3.0.3 does not properly limit the contents of the /local/domain xenstore directory tree, and does not properly restrict a guest VM's write access within this tree, which allows guest OS users to cause a denial of service and possibly have unspecified other impact by writing to (1) console/tty, (2) console/limit, or (3) image/device-model-pid. NOTE: this issue was originally reported as an issue in libvirt 0.3.3 and xenstore, but CVE is considering the core issue to be related to Xen.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 64% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
XE
Xen · Citrix
3.0.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2008-4405
CVE.org
https://www.cve.org/CVERecord?id=CVE-2008-4405
lists.opensuse.org
http://lists.opensuse.org/opensuse-security-announce/2009-09/msg00001.html
lists.xensource.com
http://lists.xensource.com/archives/html/xen-devel/2008-09/msg00992.html
lists.xensource.com
http://lists.xensource.com/archives/html/xen-devel/2008-09/msg00994.html
openwall.com
http://openwall.com/lists/oss-security/2008/09/30/6
secunia.com
http://secunia.com/advisories/32064
www.mandriva.com
http://www.mandriva.com/security/advisories?name=MDVSA-2009:016
More from Xen
–
CVE-2011-3262
tools/libxc/xc_dom_bzimageloader.c in Xen 3.2, 3.3, 4.0, and 4.1 allows local users to cause a denial of service (management software infinite loop and management domain resource…
–
CVE-2011-1898
Xen 4.1 before 4.1.1 and 4.0 before 4.0.2, when using PCI passthrough on Intel VT-d chipsets that do not have interrupt remapping, allows guest OS users to gain host OS privileges…
–
CVE-2011-1583
Multiple integer overflows in tools/libxc/xc_dom_bzimageloader.c in Xen 3.2, 3.3, 4.0, and 4.1 allow local users to cause a denial of service and possibly execute arbitrary code…
–
CVE-2010-4255
The fixup_page_fault function in arch/x86/traps.c in Xen 4.0.1 and earlier on 64-bit platforms, when paravirtualization is enabled, does not verify that kernel mode is used to…
–
CVE-2010-4238
The vbd_create function in Xen 3.1.2, when the Linux kernel 2.6.18 on Red Hat Enterprise Linux (RHEL) 5 is used, allows guest OS users to cause a denial of service (host OS panic)…