XE
Product
Xen
490
CVEs
0
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 16High 134Medium 162Low 11
Watch
Add Xen to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-34324 | 4.9 | Jan 5 | Closing of an event channel in the Linux kernel can result in a deadlock Affected: All versions, or not specified |
| CVE-2021-28700 | 4.9 | Aug 27 | xen/arm: No memory limit for dom0less domUs The dom0less feature allows an administrator to create multiple unprivileged domains directly from Xen Affected: 4.12.0 and later |
| CVE-2024-2201 | 4.7 | Dec 19 | No description published yet Affected: See advisory "x86: Native Branch History Injection" |
| CVE-2023-46836 | 4.7 | Jan 5 | The fixes for XSA-422 (Branch Type Confusion) and XSA-434 (Speculative Return Stack Overflow) are not IRQ-safe Affected: All versions, or not specified |
| CVE-2020-25604 | 4.7 | Sep 23 | An issue was discovered in Xen through 4.14.x Affected: through 4.14.0 |
| CVE-2016-4963 | 4.7 | Jun 7 | The libxl device-handling in Xen through 4.6.x allows local guest OS users with access to the driver domain to cause a denial of service (management tool confusion) by… Affected: 4.0.0; 4.0.1; 4.0.2; 4.0.3; 4.0.4; 4.1.0; +30 more |
| CVE-2022-23035 | 4.6 | Jan 25 | Insufficient cleanup of passed-through device IRQs The management of IRQs associated with physical devices exposed to x86 HVM guests involves an iterative operation in particular… Affected: 4.6.0 and later |
| CVE-2020-28368 | 4.4 | Nov 10 | Xen through 4.14.x allows guest OS administrators to obtain sensitive information (such as AES keys from outside the guest) via a side-channel attack on a power/energy monitoring… Affected: through 4.14.0 |
| CVE-2015-8552 | 4.4 | Apr 13 | The PCI backend driver in Xen, when running on an x86 system and using Linux 3.1.x through 4.3.x as the driver domain, allows local guest administrators to generate a continuous… Affected: 3.1.3; 3.1.4; 3.2.0; 3.2.1; 3.2.2; 3.2.3; +32 more |
| CVE-2025-27465 | 4.3 | Jul 16 | x86: Incorrect stubs exception handling for flags recovery Affected: 4.9.0 and later |
| CVE-2023-46840 | 4.1 | Mar 20 | Incorrect placement of a preprocessor directive in source code results in logic that doesn't operate as intended when support for HVM guests is compiled out of Xen Affected: 4.17 and later |
| CVE-2016-7094 | 4.1 | Sep 21 | Buffer overflow in Xen 4.7.x and earlier allows local x86 HVM guest OS administrators on guests running with shadow paging to cause a denial of service via a pagetable update Affected: through 4.7.0 |
| CVE-2022-33747 | 3.8 | Oct 11 | Arm: unbounded memory consumption for 2nd-level page tables Certain actions require e.g Affected: All versions, or not specified |
| CVE-2017-7995 | 3.8 | May 3 | Xen PV guest before Xen 4.3 checked access permissions to MMIO ranges only after accessing them, allowing host PCI device space memory reads, leading to information disclosure Affected: through 4.2.5 |
| CVE-2016-3159 | 3.8 | Apr 13 | The fpu_fxrstor function in arch/x86/i387.c in Xen 4.x does not properly handle writes to the hardware FSW.ES bit when running on AMD64 processors, which allows local guest OS… Affected: 4.3.0 through 4.3.4; 4.4.0 through 4.4.4; 4.5.0 through 4.5.3; 4.6.0 through 4.6.1 |
| CVE-2016-3158 | 3.8 | Apr 13 | The xrstor function in arch/x86/xstate.c in Xen 4.x does not properly handle writes to the hardware FSW.ES bit when running on AMD64 processors, which allows local guest OS users… Affected: through 4.4.0 |
| CVE-2015-6815 | 3.5 | Jan 31 | The process_tx_desc function in hw/net/e1000.c in QEMU before 2.4.0.1 does not properly process transmit descriptor data when sending a network packet, which allows attackers to… Affected: 4.4.3; 4.5.1 |
| CVE-2023-46837 | 3.3 | Jan 5 | Arm provides multiple helpers to clean & invalidate the cache for a given region Affected: through 4.16 |
| CVE-2023-34321 | 3.3 | Jan 5 | Arm provides multiple helpers to clean & invalidate the cache for a given region Affected: through 4.16 |
| CVE-2022-42336 | 3.3 | May 17 | Mishandling of guest SSBD selection on AMD hardware The current logic to set SSBD on AMD Family 17h and Hygon Family 18h processors requires that the setting of SSBD is… Affected: 4.17 |
| CVE-2016-9932 | 3.3 | Jan 26 | CMPXCHG8B emulation in Xen 3.3.x through 4.7.x on x86 systems allows local HVM guest OS users to obtain sensitive information from host stack memory via a "supposedly-ignored"… Affected: 3.3.0; 3.3.1; 3.3.2; 3.4.0; 3.4.1; 3.4.2; +34 more |
| CVE-2026-23553 | 2.9 | Jan 28 | x86: incomplete IBPB for vCPU isolation Affected: 4.6.0 and later |
| CVE-2020-29480 | 2.3 | Dec 15 | An issue was discovered in Xen through 4.14.x Affected: through 4.14.0 |
| CVE-2015-8341 | – | Dec 17 | The libxl toolstack library in Xen 4.1.x through 4.6.x does not properly release mappings of files used as kernels and initial ramdisks when managing multiple domains in the same… Affected: 4.1.0; 4.1.1; 4.1.2; 4.1.3; 4.1.4; 4.1.5; +21 more |
| CVE-2015-8340 | – | Dec 17 | The memory_exchange function in common/memory.c in Xen 3.2.x through 4.6.x does not properly release locks, which might allow guest OS administrators to cause a denial of service… Affected: 3.2.0; 3.2.1; 3.2.2; 3.2.3; 3.3.0; 3.3.1; +34 more |
| CVE-2015-8339 | – | Dec 17 | The memory_exchange function in common/memory.c in Xen 3.2.x through 4.6.x does not properly hand back pages to a domain, which might allow guest OS administrators to cause a… Affected: 3.2.0; 3.2.1; 3.2.2; 3.2.3; 3.3.0; 3.3.1; +34 more |
| CVE-2015-8338 | – | Dec 17 | Xen 4.6.x and earlier does not properly enforce limits on page order inputs for the (1) XENMEM_increase_reservation, (2) XENMEM_populate_physmap, (3) XENMEM_exchange, and possibly… Affected: through 4.6.0 |
| CVE-2015-7812 | – | Nov 17 | The hypercall_create_continuation function in arch/arm/domain.c in Xen 4.4.x through 4.6.x allows local guest users to cause a denial of service (host crash) via a preemptible… Affected: 4.4.0; 4.4.1; 4.4.2; 4.4.3; 4.5.0; 4.5.1; +2 more |
| CVE-2015-5307 | – | Nov 16 | The KVM subsystem in the Linux kernel through 4.2.6, and Xen 4.3.x through 4.6.x, allows guest OS users to cause a denial of service (host OS panic or hang) by triggering many #AC… Affected: 4.3.0; 4.3.1; 4.3.2; 4.3.3; 4.3.4; 4.4.0; +16 more |
| CVE-2015-7972 | – | Oct 30 | The (1) libxl_set_memory_target function in tools/libxl/libxl.c and (2) libxl__build_post function in tools/libxl/libxl_dom.c in Xen 3.4.x through 4.6.x do not properly calculate… Affected: 3.4.0; 3.4.1; 3.4.2; 3.4.3; 3.4.4; 4.0.0; +24 more |
| CVE-2015-7971 | – | Oct 30 | Xen 3.2.x through 4.6.x does not limit the number of printk console messages when logging certain pmu and profiling hypercalls, which allows local guests to cause a denial of… Affected: 3.2.0; 3.2.1; 3.2.2; 3.2.3; 3.3.0; 3.3.1; +31 more |
| CVE-2015-7970 | – | Oct 30 | The p2m_pod_emergency_sweep function in arch/x86/mm/p2m-pod.c in Xen 3.4.x, 3.5.x, and 3.6.x is not preemptible, which allows local x86 HVM guest administrators to cause a denial… Affected: 3.4.0; 3.4.1; 3.4.2; 3.4.3; 3.4.4 |
| CVE-2015-7969 | – | Oct 30 | Multiple memory leaks in Xen 4.0 through 4.6.x allow local guest administrators or domains with certain permission to cause a denial of service (memory consumption) via a large… Affected: 4.0.0; 4.0.1; 4.0.2; 4.0.3; 4.0.4; 4.1.0; +19 more |
| CVE-2015-7835 | – | Oct 30 | The mod_l2_entry function in arch/x86/mm.c in Xen 3.4 through 4.6.x does not properly validate level 2 page table entries, which allows local PV guest administrators to gain… Affected: 3.4.0; 3.4.1; 3.4.2; 3.4.3; 3.4.4; 4.0.0; +24 more |
| CVE-2015-7814 | – | Oct 30 | Race condition in the relinquish_memory function in arch/arm/domain.c in Xen 4.6.x and earlier allows local domains with partial management control to cause a denial of service… Affected: through 4.6.0 |
| CVE-2015-7813 | – | Oct 30 | Xen 4.4.x, 4.5.x, and 4.6.x does not limit the number of printk console messages when reporting unimplemented hypercalls, which allows local guests to cause a denial of service… Affected: 4.4.0; 4.4.0; 4.4.1; 4.5.0; 4.5.1; 4.6.0 |
| CVE-2015-7311 | – | Oct 1 | libxl in Xen 4.1.x through 4.6.x does not properly handle the readonly flag on disks when using the qemu-xen device model, which allows local guest users to write to a read-only… Affected: 4.1.0; 4.1.1; 4.1.2; 4.1.3; 4.1.4; 4.1.5; +17 more |
| CVE-2015-6654 | – | Sep 3 | The xenmem_add_to_physmap_one function in arch/arm/mm.c in Xen 4.5.x, 4.4.x, and earlier does not limit the number of printk console messages when reporting a failure to retrieve… Affected: 4.4.0; 4.5.0; 4.5.1 |
| CVE-2015-5166 | – | Aug 12 | Use-after-free vulnerability in QEMU in Xen 4.5.x and earlier does not completely unplug emulated block devices, which allows local HVM guest users to gain privileges by… Affected: through 4.5.0; 4.5.1 |
| CVE-2015-5165 | – | Aug 12 | The C+ mode offload emulation in the RTL8139 network card device model in QEMU, as used in Xen 4.5.x and earlier, allows remote attackers to read process heap memory via… Affected: through 4.5.0; 4.5.1 |
| CVE-2015-5154 | – | Aug 12 | Heap-based buffer overflow in the IDE subsystem in QEMU, as used in Xen 4.5.x and earlier, when the container has a CDROM drive enabled, allows local guest users to execute… Affected: through 4.5.0; 4.5.1 |
| CVE-2015-3259 | – | Jul 16 | Stack-based buffer overflow in the xl command line utility in Xen 4.1.x through 4.5.x allows local guest administrators to gain privileges via a long configuration argument Affected: 4.1.0; 4.1.1; 4.1.2; 4.1.3; 4.1.4; 4.1.5; +13 more |
| CVE-2015-4164 | – | Jun 15 | The compat_iret function in Xen 3.1 through 4.5 iterates the wrong way through a loop, which allows local 32-bit PV guest administrators to cause a denial of service (large loop… Affected: 3.1.3; 3.1.4; 3.2.0; 3.2.1; 3.2.2; 3.2.3; +31 more |
| CVE-2015-4163 | – | Jun 15 | GNTTABOP_swap_grant_ref in Xen 4.2 through 4.5 does not check the grant table operation version, which allows local guest domains to cause a denial of service (NULL pointer… Affected: 4.2.0; 4.2.1; 4.2.2; 4.2.3; 4.3.0; 4.3.1; +5 more |
| CVE-2015-4105 | – | Jun 3 | Xen 3.3.x through 4.5.x enables logging for PCI MSI-X pass-through error messages, which allows local x86 HVM guests to cause a denial of service (host disk consumption) via… Affected: 3.3.0; 3.3.1; 3.3.2; 3.4.0; 3.4.1; 3.4.2; +25 more |
| CVE-2015-4104 | – | Jun 3 | Xen 3.3.x through 4.5.x does not properly restrict access to PCI MSI mask bits, which allows local x86 HVM guest users to cause a denial of service (unexpected interrupt and host… Affected: 3.3.0; 3.3.1; 3.3.2; 3.4.0; 3.4.1; 3.4.2; +25 more |
| CVE-2015-4103 | – | Jun 3 | Xen 3.3.x through 4.5.x does not properly restrict write access to the host MSI message data field, which allows local x86 HVM guest administrators to cause a denial of service… Affected: 3.3.0; 3.3.1; 3.3.2; 3.4.0; 3.4.1; 3.4.2; +24 more |
| CVE-2015-3456 | – | May 13 | The Floppy Disk Controller (FDC) in QEMU, as used in Xen 4.5.x and earlier and KVM, allows local guest users to cause a denial of service (out-of-bounds write and guest crash) or… Affected: 4.5.0 |
| CVE-2015-3340 | – | Apr 28 | Xen 4.2.x through 4.5.x does not initialize certain fields, which allows certain remote service domains to obtain sensitive information from memory via a (1) XEN_DOMCTL_gettscinfo… Affected: 4.2.0; 4.2.1; 4.2.2; 4.2.3; 4.2.4; 4.2.5; +9 more |
| CVE-2015-0777 | – | Apr 5 | drivers/xen/usbback/usbback.c in linux-2.6.18-xen-3.4.0 (aka the Xen 3.4.x support patches for the Linux kernel 2.6.18), as used in the Linux kernel 2.6.x and 3.x in SUSE Linux… Affected: 3.4.0; 3.4.1; 3.4.2; 3.4.3; 3.4.4 |