xen (SUSE:Linux Enterprise Module for Basesystem 15 SP1) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the SUSE:Linux Enterprise Module for Basesystem 15 SP1 package xen, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (54)

• CVE-2019-18425 — CVSS 9.8 (critical): An issue was discovered in Xen through 4.12.x allowing 32-bit PV guest OS users to gain guest OS privileges by installing and using…
• CVE-2019-18423 — CVSS 8.8 (high): An issue was discovered in Xen through 4.12.x allowing ARM guest OS users to cause a denial of service via a XENMEM_add_to_physmap…
• CVE-2019-18422 — CVSS 8.8 (high): An issue was discovered in Xen through 4.12.x allowing ARM guest OS users to cause a denial of service or gain privileges by leveraging the…
• CVE-2020-29481 — CVSS 8.8 (high): An issue was discovered in Xen through 4.14.x. Access rights of Xenstore nodes are per domid. Unfortunately, existing granted access rights…
• CVE-2019-19578 — CVSS 8.8 (high): An issue was discovered in Xen through 4.12.x allowing x86 PV guest OS users to cause a denial of service via degenerate chains of linear…
• CVE-2020-15565 — CVSS 8.8 (high): An issue was discovered in Xen through 4.13.x, allowing x86 Intel HVM guest OS users to cause a host OS denial of service or possibly gain…
• CVE-2020-11741 — CVSS 8.8 (high): An issue was discovered in xenoprof in Xen through 4.13.x, allowing guest OS users (with active profiling) to obtain sensitive information…
• CVE-2020-15567 — CVSS 7.8 (high): An issue was discovered in Xen through 4.13.x, allowing Intel guest OS users to gain privileges or cause a denial of service because of…
• CVE-2020-27671 — CVSS 7.8 (high): An issue was discovered in Xen through 4.14.x allowing x86 HVM and PVH guest OS users to cause a denial of service (data corruption), cause…
• CVE-2020-27670 — CVSS 7.8 (high): An issue was discovered in Xen through 4.14.x allowing x86 guest OS users to cause a denial of service (data corruption), cause a data…
• CVE-2020-25603 — CVSS 7.8 (high): An issue was discovered in Xen through 4.14.x. There are missing memory barriers when accessing/allocating an event channel. Event channels…
• CVE-2020-11739 — CVSS 7.8 (high): An issue was discovered in Xen through 4.13.x, allowing guest OS users to cause a denial of service or possibly gain privileges because of…
• CVE-2020-25595 — CVSS 7.8 (high): An issue was discovered in Xen through 4.14.x. The PCI passthrough code improperly uses register data. Code paths in Xen's MSI handling…
• CVE-2019-18421 — CVSS 7.5 (high): An issue was discovered in Xen through 4.12.x allowing x86 PV guest OS users to gain host OS privileges by leveraging race conditions in…
• CVE-2019-19583 — CVSS 7.5 (high): An issue was discovered in Xen through 4.12.x allowing x86 HVM/PVH guest OS users to cause a denial of service (guest OS crash) because VMX…
• CVE-2019-19577 — CVSS 7.2 (high): An issue was discovered in Xen through 4.12.x allowing x86 AMD HVM guest OS users to cause a denial of service or possibly gain privileges…
• CVE-2020-25599 — CVSS 7.0 (high): An issue was discovered in Xen through 4.14.x. There are evtchn_reset() race conditions. Uses of EVTCHNOP_reset (potentially by a guest on…
• CVE-2020-27672 — CVSS 7.0 (high): An issue was discovered in Xen through 4.14.x allowing x86 guest OS users to cause a host OS denial of service, achieve data corruption, or…
• CVE-2019-18424 — CVSS 6.8 (medium): An issue was discovered in Xen through 4.12.x allowing attackers to gain host OS privileges via DMA in a situation where an untrusted…
• CVE-2019-19579 — CVSS 6.8 (medium): An issue was discovered in Xen through 4.12.x allowing attackers to gain host OS privileges via DMA in a situation where an untrusted…
• CVE-2019-19580 — CVSS 6.6 (medium): An issue was discovered in Xen through 4.12.x allowing x86 PV guest OS users to gain host OS privileges by leveraging race conditions in…
• CVE-2019-18420 — CVSS 6.5 (medium): An issue was discovered in Xen through 4.12.x allowing x86 PV guest OS users to cause a denial of service via a VCPUOP_initialise…
• CVE-2020-15563 — CVSS 6.5 (medium): An issue was discovered in Xen through 4.13.x, allowing x86 HVM guest OS users to cause a hypervisor crash. An inverted conditional in x86…
• CVE-2019-19581 — CVSS 6.5 (medium): An issue was discovered in Xen through 4.12.x allowing 32-bit Arm guest OS users to cause a denial of service (out-of-bounds access)…
• CVE-2019-19582 — CVSS 6.5 (medium): An issue was discovered in Xen through 4.12.x allowing x86 guest OS users to cause a denial of service (infinite loop) because certain bit…
• CVE-2019-11135 — CVSS 6.5 (medium): TSX Asynchronous Abort condition on some CPUs utilizing speculative execution may allow an authenticated user to potentially enable…
• CVE-2020-29483 — CVSS 6.5 (medium): An issue was discovered in Xen through 4.14.x. Xenstored and guests communicate via a shared memory page using a specific protocol. When a…
• CVE-2018-12207 — CVSS 6.5 (medium): Improper invalidation for page table updates by a virtual guest operating system for multiple Intel(R) Processors may allow an…
• CVE-2020-25597 — CVSS 6.5 (medium): An issue was discovered in Xen through 4.14.x. There is mishandling of the constraint that once-valid event channels may not turn invalid…
• CVE-2020-15566 — CVSS 6.5 (medium): An issue was discovered in Xen through 4.13.x, allowing guest OS users to cause a host OS crash because of incorrect error handling in…
• CVE-2020-29571 — CVSS 6.2 (medium): An issue was discovered in Xen through 4.14.x. A bounds check common to most operation time functions specific to FIFO event channels…
• CVE-2020-29570 — CVSS 6.2 (medium): An issue was discovered in Xen through 4.14.x. Recording of the per-vCPU control block mapping maintained by Xen and that of pointers into…
• CVE-2020-25602 — CVSS 6.0 (medium): An issue was discovered in Xen through 4.14.x. An x86 PV guest can trigger a host OS crash when handling guest access to MSR_MISC_ENABLE…
• CVE-2020-29484 — CVSS 6.0 (medium): An issue was discovered in Xen through 4.14.x. When a Xenstore watch fires, the xenstore client that registered the watch will receive a…
• CVE-2018-12130 — CVSS 5.9 (medium): Microarchitectural Fill Buffer Data Sampling (MFBDS): Fill buffers on some microprocessors utilizing speculative execution may allow an…
• CVE-2018-12126 — CVSS 5.6 (medium): Microarchitectural Store Buffer Data Sampling (MSBDS): Store buffers on some microprocessors utilizing speculative execution may allow an…
• CVE-2019-11091 — CVSS 5.6 (medium): Microarchitectural Data Sampling Uncacheable Memory (MDSUM): Uncacheable memory on some microprocessors utilizing speculative execution may…
• CVE-2018-12127 — CVSS 5.6 (medium): Microarchitectural Load Port Data Sampling (MLPDS): Load ports on some microprocessors utilizing speculative execution may allow an…
• CVE-2020-0543 — CVSS 5.5 (medium): Incomplete cleanup from specific special register read operations in some Intel(R) Processors may allow an authenticated user to…
• CVE-2019-17350 — CVSS 5.5 (medium): An issue was discovered in Xen through 4.12.x allowing Arm domU attackers to cause a denial of service (infinite loop) involving a…
• CVE-2019-17349 — CVSS 5.5 (medium): An issue was discovered in Xen through 4.12.x allowing Arm domU attackers to cause a denial of service (infinite loop) involving a LoadExcl…
• CVE-2020-27673 — CVSS 5.5 (medium): An issue was discovered in the Linux kernel through 5.9.1, as used with Xen through 4.14.x. Guest OS users can cause a denial of service…
• CVE-2020-11743 — CVSS 5.5 (medium): An issue was discovered in Xen through 4.13.x, allowing guest OS users to cause a denial of service because of a bad error path in…
• CVE-2020-11742 — CVSS 5.5 (medium): An issue was discovered in Xen through 4.13.x, allowing guest OS users to cause a denial of service because of bad continuation handling in…
• CVE-2020-25598 — CVSS 5.5 (medium): An issue was discovered in Xen 4.14.x. There is a missing unlock in the XENMEM_acquire_resource error path. The RCU (Read, Copy, Update)…
• CVE-2020-11740 — CVSS 5.5 (medium): An issue was discovered in xenoprof in Xen through 4.13.x, allowing guest OS users (without active profiling) to obtain sensitive…
• CVE-2020-25600 — CVSS 5.5 (medium): An issue was discovered in Xen through 4.14.x. Out of bounds event channels are available to 32-bit x86 domains. The so called 2-level…
• CVE-2020-25601 — CVSS 5.5 (medium): An issue was discovered in Xen through 4.14.x. There is a lack of preemption in evtchn_reset() / evtchn_destroy(). In particular, the FIFO…
• CVE-2020-29566 — CVSS 5.5 (medium): An issue was discovered in Xen through 4.14.x. When they require assistance from the device model, x86 HVM guests must be temporarily…
• CVE-2020-25596 — CVSS 5.5 (medium): An issue was discovered in Xen through 4.14.x. x86 PV guest kernels can experience denial of service via SYSENTER. The SYSENTER instruction…
• CVE-2020-27674 — CVSS 5.3 (medium): An issue was discovered in Xen through 4.14.x allowing x86 PV guest OS users to gain guest OS privileges by modifying kernel memory…
• CVE-2020-25604 — CVSS 4.7 (medium): An issue was discovered in Xen through 4.14.x. There is a race condition when migrating timers between x86 HVM vCPUs. When migrating timers…
• CVE-2020-28368 — CVSS 4.4 (medium): Xen through 4.14.x allows guest OS administrators to obtain sensitive information (such as AES keys from outside the guest) via a…
• CVE-2020-29480 — CVSS 2.3 (low): An issue was discovered in Xen through 4.14.x. Neither xenstore implementation does any permission checks when reporting a xenstore watch…