xen (SUSE:Linux Enterprise Module for Server Applications 15 SP2) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the SUSE:Linux Enterprise Module for Server Applications 15 SP2 package xen, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (49)

• CVE-2020-15565 — CVSS 8.8 (high): An issue was discovered in Xen through 4.13.x, allowing x86 Intel HVM guest OS users to cause a host OS denial of service or possibly gain…
• CVE-2021-28707 — CVSS 8.8 (high): PoD operations on misaligned GFNs T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities…
• CVE-2020-29481 — CVSS 8.8 (high): An issue was discovered in Xen through 4.14.x. Access rights of Xenstore nodes are per domid. Unfortunately, existing granted access rights…
• CVE-2021-28704 — CVSS 8.8 (high): PoD operations on misaligned GFNs T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities…
• CVE-2021-28708 — CVSS 8.8 (high): PoD operations on misaligned GFNs T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities…
• CVE-2021-28706 — CVSS 8.6 (high): guests may exceed their designated memory limit When a guest is permitted to have close to 16TiB of memory, it may be able to issue…
• CVE-2021-28701 — CVSS 7.8 (high): Another race in XENMAPSPACE_grant_table handling Guests are permitted access to certain Xen-owned pages of memory. The majority of such…
• CVE-2020-25603 — CVSS 7.8 (high): An issue was discovered in Xen through 4.14.x. There are missing memory barriers when accessing/allocating an event channel. Event channels…
• CVE-2020-27670 — CVSS 7.8 (high): An issue was discovered in Xen through 4.14.x allowing x86 guest OS users to cause a denial of service (data corruption), cause a data…
• CVE-2021-28705 — CVSS 7.8 (high): issues with partially successful P2M updates on x86 T[his CNA information record relates to multiple CVEs; the text explains which…
• CVE-2020-15567 — CVSS 7.8 (high): An issue was discovered in Xen through 4.13.x, allowing Intel guest OS users to gain privileges or cause a denial of service because of…
• CVE-2020-25595 — CVSS 7.8 (high): An issue was discovered in Xen through 4.14.x. The PCI passthrough code improperly uses register data. Code paths in Xen's MSI handling…
• CVE-2021-28709 — CVSS 7.8 (high): issues with partially successful P2M updates on x86 T[his CNA information record relates to multiple CVEs; the text explains which…
• CVE-2021-28697 — CVSS 7.8 (high): grant table v2 status pages may remain accessible after de-allocation Guest get permitted access to certain Xen-owned pages of memory. The…
• CVE-2020-27671 — CVSS 7.8 (high): An issue was discovered in Xen through 4.14.x allowing x86 HVM and PVH guest OS users to cause a denial of service (data corruption), cause…
• CVE-2021-28702 — CVSS 7.6 (high): PCI devices with RMRRs not deassigned correctly Certain PCI devices in a system might be assigned Reserved Memory Regions (specified via…
• CVE-2021-28692 — CVSS 7.1 (high): inappropriate x86 IOMMU timeout detection / handling IOMMUs process commands issued to them in parallel with the operation of the CPU(s)…
• CVE-2020-25599 — CVSS 7.0 (high): An issue was discovered in Xen through 4.14.x. There are evtchn_reset() race conditions. Uses of EVTCHNOP_reset (potentially by a guest on…
• CVE-2020-27672 — CVSS 7.0 (high): An issue was discovered in Xen through 4.14.x allowing x86 guest OS users to cause a host OS denial of service, achieve data corruption, or…
• CVE-2021-28694 — CVSS 6.8 (medium): IOMMU page mapping issues on x86 T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities…
• CVE-2021-28696 — CVSS 6.8 (medium): IOMMU page mapping issues on x86 T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities…
• CVE-2021-28695 — CVSS 6.8 (medium): IOMMU page mapping issues on x86 T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities…
• CVE-2020-15566 — CVSS 6.5 (medium): An issue was discovered in Xen through 4.13.x, allowing guest OS users to cause a host OS crash because of incorrect error handling in…
• CVE-2020-29483 — CVSS 6.5 (medium): An issue was discovered in Xen through 4.14.x. Xenstored and guests communicate via a shared memory page using a specific protocol. When a…
• CVE-2021-0089 — CVSS 6.5 (medium): Observable response discrepancy in some Intel(R) Processors may allow an authorized user to potentially enable information disclosure via…
• CVE-2021-28690 — CVSS 6.5 (medium): x86: TSX Async Abort protections not restored after S3 This issue relates to the TSX Async Abort speculative security vulnerability. Please…
• CVE-2020-15563 — CVSS 6.5 (medium): An issue was discovered in Xen through 4.13.x, allowing x86 HVM guest OS users to cause a hypervisor crash. An inverted conditional in x86…
• CVE-2020-25597 — CVSS 6.5 (medium): An issue was discovered in Xen through 4.14.x. There is mishandling of the constraint that once-valid event channels may not turn invalid…
• CVE-2020-29570 — CVSS 6.2 (medium): An issue was discovered in Xen through 4.14.x. Recording of the per-vCPU control block mapping maintained by Xen and that of pointers into…
• CVE-2020-29571 — CVSS 6.2 (medium): An issue was discovered in Xen through 4.14.x. A bounds check common to most operation time functions specific to FIFO event channels…
• CVE-2020-29484 — CVSS 6.0 (medium): An issue was discovered in Xen through 4.14.x. When a Xenstore watch fires, the xenstore client that registered the watch will receive a…
• CVE-2020-25602 — CVSS 6.0 (medium): An issue was discovered in Xen through 4.14.x. An x86 PV guest can trigger a host OS crash when handling guest access to MSR_MISC_ENABLE…
• CVE-2021-28693 — CVSS 5.5 (medium): xen/arm: Boot modules are not scrubbed The bootloader will load boot modules (e.g. kernel, initramfs...) in a temporary area before they…
• CVE-2021-28687 — CVSS 5.5 (medium): HVM soft-reset crashes toolstack libxl requires all data structures passed across its public interface to be initialized before use and…
• CVE-2020-29566 — CVSS 5.5 (medium): An issue was discovered in Xen through 4.14.x. When they require assistance from the device model, x86 HVM guests must be temporarily…
• CVE-2020-0543 — CVSS 5.5 (medium): Incomplete cleanup from specific special register read operations in some Intel(R) Processors may allow an authenticated user to…
• CVE-2020-25601 — CVSS 5.5 (medium): An issue was discovered in Xen through 4.14.x. There is a lack of preemption in evtchn_reset() / evtchn_destroy(). In particular, the FIFO…
• CVE-2020-25600 — CVSS 5.5 (medium): An issue was discovered in Xen through 4.14.x. Out of bounds event channels are available to 32-bit x86 domains. The so called 2-level…
• CVE-2020-25598 — CVSS 5.5 (medium): An issue was discovered in Xen 4.14.x. There is a missing unlock in the XENMEM_acquire_resource error path. The RCU (Read, Copy, Update)…
• CVE-2020-25596 — CVSS 5.5 (medium): An issue was discovered in Xen through 4.14.x. x86 PV guest kernels can experience denial of service via SYSENTER. The SYSENTER instruction…
• CVE-2021-3308 — CVSS 5.5 (medium): An issue was discovered in Xen 4.12.3 through 4.12.4 and 4.13.1 through 4.14.x. An x86 HVM guest with PCI pass through devices can force…
• CVE-2021-28698 — CVSS 5.5 (medium): long running loops in grant table handling In order to properly monitor resource use, Xen maintains information on the grant mappings a…
• CVE-2021-28699 — CVSS 5.5 (medium): inadequate grant-v2 status frames array bounds check The v2 grant table interface separates grant attributes from grant status. That is…
• CVE-2020-27673 — CVSS 5.5 (medium): An issue was discovered in the Linux kernel through 5.9.1, as used with Xen through 4.14.x. Guest OS users can cause a denial of service…
• CVE-2020-27674 — CVSS 5.3 (medium): An issue was discovered in Xen through 4.14.x allowing x86 PV guest OS users to gain guest OS privileges by modifying kernel memory…
• CVE-2021-28700 — CVSS 4.9 (medium): xen/arm: No memory limit for dom0less domUs The dom0less feature allows an administrator to create multiple unprivileged domains directly…
• CVE-2020-25604 — CVSS 4.7 (medium): An issue was discovered in Xen through 4.14.x. There is a race condition when migrating timers between x86 HVM vCPUs. When migrating timers…
• CVE-2020-28368 — CVSS 4.4 (medium): Xen through 4.14.x allows guest OS administrators to obtain sensitive information (such as AES keys from outside the guest) via a…
• CVE-2020-29480 — CVSS 2.3 (low): An issue was discovered in Xen through 4.14.x. Neither xenstore implementation does any permission checks when reporting a xenstore watch…