CVE-2010-4255
CVE-2010-4255 is a medium-severity vulnerability in Citrix Xen with a CVSS 2.0 base score of 6.1. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.
Key facts
- Severity: Medium (CVSS 2.0 base score 6.1)
- EPSS exploit prediction: 1% (51st percentile)
- Actively exploited: Not listed in CISA KEV
- Affected product: Citrix Xen
- Published:
- Last modified:
Description
The fixup_page_fault function in arch/x86/traps.c in Xen 4.0.1 and earlier on 64-bit platforms, when paravirtualization is enabled, does not verify that kernel mode is used to call the handle_gdt_ldt_mapping_fault function, which allows guest OS users to cause a denial of service (host OS BUG_ON) via a crafted memory access.
Frequently asked questions
- What is CVE-2010-4255?
- The fixup_page_fault function in arch/x86/traps.c in Xen 4.0.1 and earlier on 64-bit platforms, when paravirtualization is enabled, does not verify that kernel mode is used to call the handle_gdt_ldt_mapping_fault function, which allows guest OS users to cause a denial of service (host OS BUG_ON) via a crafted memory access.
- How severe is CVE-2010-4255?
- CVE-2010-4255 has a CVSS 2.0 base score of 6.1, rated medium severity.
- Is CVE-2010-4255 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (51st percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2010-4255?
- CVE-2010-4255 primarily affects Citrix Xen. In total, 19 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
- How do I fix CVE-2010-4255?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- When was CVE-2010-4255 published?
- CVE-2010-4255 was published on 2011-01-25 and last updated on 2026-06-16.
References
- http://lists.xensource.com/archives/html/xen-devel/2010-11/msg01650.html
- http://openwall.com/lists/oss-security/2010/11/30/5
- http://openwall.com/lists/oss-security/2010/11/30/8
- http://secunia.com/advisories/42884
- http://secunia.com/advisories/46397
- http://www.redhat.com/support/errata/RHSA-2011-0017.html
- http://www.securityfocus.com/archive/1/520102/100/0/threaded
- http://www.vmware.com/security/advisories/VMSA-2011-0012.html
- https://bugzilla.redhat.com/show_bug.cgi?id=658155
Affected products (19)
- cpe:2.3:a:citrix:xen:*:*:*:*:*:*:*:*
- cpe:2.3:a:citrix:xen:3.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:citrix:xen:3.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:citrix:xen:3.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:citrix:xen:3.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:citrix:xen:3.1.3:*:*:*:*:*:*:*
- cpe:2.3:a:citrix:xen:3.1.4:*:*:*:*:*:*:*
- cpe:2.3:a:citrix:xen:3.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:citrix:xen:3.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:citrix:xen:3.2.2:*:*:*:*:*:*:*
- cpe:2.3:a:citrix:xen:3.2.3:*:*:*:*:*:*:*
- cpe:2.3:a:citrix:xen:3.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:citrix:xen:3.3.1:*:*:*:*:*:*:*
- cpe:2.3:a:citrix:xen:3.3.2:*:*:*:*:*:*:*
- cpe:2.3:a:citrix:xen:3.4.0:*:*:*:*:*:*:*
- cpe:2.3:a:citrix:xen:3.4.1:*:*:*:*:*:*:*
- cpe:2.3:a:citrix:xen:3.4.2:*:*:*:*:*:*:*
- cpe:2.3:a:citrix:xen:3.4.3:*:*:*:*:*:*:*
- cpe:2.3:a:citrix:xen:4.0.0:*:*:*:*:*:*:*
More vulnerabilities in Citrix Xen
- CVE-2011-1898 — High (CVSS 7.4): Xen 4.1 before 4.1.1 and 4.0 before 4.0.2, when using PCI passthrough on Intel VT-d chipsets that do not have interrupt…
- CVE-2008-5716 — High (CVSS 7.2): xend in Xen 3.3.0 does not properly restrict a guest VM's write access within the /local/domain xenstore directory…
- CVE-2008-4405 — High (CVSS 7.2): xend in Xen 3.0.3 does not properly limit the contents of the /local/domain xenstore directory tree, and does not…
- CVE-2011-1583 — Medium (CVSS 6.9): Multiple integer overflows in tools/libxc/xc_dom_bzimageloader.c in Xen 3.2, 3.3, 4.0, and 4.1 allow local users to…
- CVE-2010-4238 — Medium (CVSS 5.5): The vbd_create function in Xen 3.1.2, when the Linux kernel 2.6.18 on Red Hat Enterprise Linux (RHEL) 5 is used, allows…
- CVE-2010-4247 — Medium (CVSS 5.5): The do_block_io_op function in (1) drivers/xen/blkback/blkback.c and (2) drivers/xen/blktap/blktap.c in Xen before…