Login Request a demo
Unscored severity · published Dec 24, 2008
CVE-2008-5716
xend in Xen 3.3.0 does not properly restrict a guest VM's write access within the /local/domain xenstore directory tree, which allows guest OS users to cause a denial of service…
–
CVSS
0.4%
EPSS
No
On KEV
Description
xend in Xen 3.3.0 does not properly restrict a guest VM's write access within the /local/domain xenstore directory tree, which allows guest OS users to cause a denial of service and possibly have unspecified other impact by writing to (1) console/tty, (2) console/limit, or (3) image/device-model-pid. NOTE: this issue exists because of erroneous set_permissions calls in the fix for CVE-2008-4405.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 29% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
XE
Xen · Citrix
3.3.0 · source: NVD
Affected product
XE
Xen
Citrix
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2008-5716
CVE.org
https://www.cve.org/CVERecord?id=CVE-2008-5716
lists.xensource.com
http://lists.xensource.com/archives/html/xen-devel/2008-12/msg00842.html
lists.xensource.com
http://lists.xensource.com/archives/html/xen-devel/2008-12/msg00845.html
lists.xensource.com
http://lists.xensource.com/archives/html/xen-devel/2008-12/msg00846.html
lists.xensource.com
http://lists.xensource.com/archives/html/xen-devel/2008-12/msg00847.html
openwall.com
http://openwall.com/lists/oss-security/2008/12/19/1
www.securityfocus.com
http://www.securityfocus.com/bid/31499
More from Xen
–
CVE-2011-3262
tools/libxc/xc_dom_bzimageloader.c in Xen 3.2, 3.3, 4.0, and 4.1 allows local users to cause a denial of service (management software infinite loop and management domain resource…
–
CVE-2011-1898
Xen 4.1 before 4.1.1 and 4.0 before 4.0.2, when using PCI passthrough on Intel VT-d chipsets that do not have interrupt remapping, allows guest OS users to gain host OS privileges…
–
CVE-2011-1583
Multiple integer overflows in tools/libxc/xc_dom_bzimageloader.c in Xen 3.2, 3.3, 4.0, and 4.1 allow local users to cause a denial of service and possibly execute arbitrary code…
–
CVE-2010-4255
The fixup_page_fault function in arch/x86/traps.c in Xen 4.0.1 and earlier on 64-bit platforms, when paravirtualization is enabled, does not verify that kernel mode is used to…
–
CVE-2010-4238
The vbd_create function in Xen 3.1.2, when the Linux kernel 2.6.18 on Red Hat Enterprise Linux (RHEL) 5 is used, allows guest OS users to cause a denial of service (host OS panic)…