Known CVE vulnerabilities and GitHub Security Advisories affecting the SUSE:OpenStack Cloud Crowbar 9 package xen, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.
CVEs (98)
CVE-2021-28708 — CVSS 8.8 (high): PoD operations on misaligned GFNs T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities…
CVE-2020-29481 — CVSS 8.8 (high): An issue was discovered in Xen through 4.14.x. Access rights of Xenstore nodes are per domid. Unfortunately, existing granted access rights…
CVE-2022-42309 — CVSS 8.8 (high): Xenstore: Guests can crash xenstored Due to a bug in the fix of XSA-115 a malicious guest can cause xenstored to use a wrong pointer during…
CVE-2020-15565 — CVSS 8.8 (high): An issue was discovered in Xen through 4.13.x, allowing x86 Intel HVM guest OS users to cause a host OS denial of service or possibly gain…
CVE-2021-28704 — CVSS 8.8 (high): PoD operations on misaligned GFNs T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities…
CVE-2022-33745 — CVSS 8.8 (high): insufficient TLB flush for x86 PV guests in shadow mode For migration as well as to work around kernels unaware of L1TF (see XSA-273), PV…
CVE-2021-28707 — CVSS 8.8 (high): PoD operations on misaligned GFNs T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities…
CVE-2021-28706 — CVSS 8.6 (high): guests may exceed their designated memory limit When a guest is permitted to have close to 16TiB of memory, it may be able to issue…
CVE-2022-42333 — CVSS 8.6 (high): x86/HVM pinned cache attributes mis-handling T[his CNA information record relates to multiple CVEs; the text explains which…
CVE-2021-27379 — CVSS 7.8 (high): An issue was discovered in Xen through 4.11.x, allowing x86 Intel HVM guest OS users to achieve unintended read/write DMA access, and…
CVE-2021-28697 — CVSS 7.8 (high): grant table v2 status pages may remain accessible after de-allocation Guest get permitted access to certain Xen-owned pages of memory. The…
CVE-2021-28701 — CVSS 7.8 (high): Another race in XENMAPSPACE_grant_table handling Guests are permitted access to certain Xen-owned pages of memory. The majority of such…
CVE-2022-42332 — CVSS 7.8 (high): x86 shadow plus log-dirty mode use-after-free In environments where host assisted address translation is necessary but Hardware Assisted…
CVE-2020-25603 — CVSS 7.8 (high): An issue was discovered in Xen through 4.14.x. There are missing memory barriers when accessing/allocating an event channel. Event channels…
CVE-2020-27670 — CVSS 7.8 (high): An issue was discovered in Xen through 4.14.x allowing x86 guest OS users to cause a denial of service (data corruption), cause a data…
CVE-2020-27671 — CVSS 7.8 (high): An issue was discovered in Xen through 4.14.x allowing x86 HVM and PVH guest OS users to cause a denial of service (data corruption), cause…
CVE-2022-26361 — CVSS 7.8 (high): IOMMU: RMRR (VT-d) and unity map (AMD-Vi) handling issues T[his CNA information record relates to multiple CVEs; the text explains which…
CVE-2022-26360 — CVSS 7.8 (high): IOMMU: RMRR (VT-d) and unity map (AMD-Vi) handling issues T[his CNA information record relates to multiple CVEs; the text explains which…
CVE-2022-26359 — CVSS 7.8 (high): IOMMU: RMRR (VT-d) and unity map (AMD-Vi) handling issues T[his CNA information record relates to multiple CVEs; the text explains which…
CVE-2020-15567 — CVSS 7.8 (high): An issue was discovered in Xen through 4.13.x, allowing Intel guest OS users to gain privileges or cause a denial of service because of…
CVE-2022-26358 — CVSS 7.8 (high): IOMMU: RMRR (VT-d) and unity map (AMD-Vi) handling issues T[his CNA information record relates to multiple CVEs; the text explains which…
CVE-2021-28709 — CVSS 7.8 (high): issues with partially successful P2M updates on x86 T[his CNA information record relates to multiple CVEs; the text explains which…
CVE-2020-25595 — CVSS 7.8 (high): An issue was discovered in Xen through 4.14.x. The PCI passthrough code improperly uses register data. Code paths in Xen's MSI handling…
CVE-2021-28705 — CVSS 7.8 (high): issues with partially successful P2M updates on x86 T[his CNA information record relates to multiple CVEs; the text explains which…
CVE-2021-28692 — CVSS 7.1 (high): inappropriate x86 IOMMU timeout detection / handling IOMMUs process commands issued to them in parallel with the operation of the CPU(s)…
CVE-2022-26357 — CVSS 7.0 (high): race in VT-d domain ID cleanup Xen domain IDs are up to 15 bits wide. VT-d hardware may allow for only less than 15 bits to hold a domain…
CVE-2020-25599 — CVSS 7.0 (high): An issue was discovered in Xen through 4.14.x. There are evtchn_reset() race conditions. Uses of EVTCHNOP_reset (potentially by a guest on…
CVE-2020-27672 — CVSS 7.0 (high): An issue was discovered in Xen through 4.14.x allowing x86 guest OS users to cause a host OS denial of service, achieve data corruption, or…
CVE-2022-42320 — CVSS 7.0 (high): Xenstore: Guests can get access to Xenstore nodes of deleted domains Access rights of Xenstore nodes are per domid. When a domain is gone…
CVE-2021-28694 — CVSS 6.8 (medium): IOMMU page mapping issues on x86 T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities…
CVE-2021-28695 — CVSS 6.8 (medium): IOMMU page mapping issues on x86 T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities…
CVE-2021-28696 — CVSS 6.8 (medium): IOMMU page mapping issues on x86 T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities…
CVE-2022-26363 — CVSS 6.7 (medium): x86 pv: Insufficient care with non-coherent mappings T[his CNA information record relates to multiple CVEs; the text explains which…
CVE-2022-26364 — CVSS 6.7 (medium): x86 pv: Insufficient care with non-coherent mappings T[his CNA information record relates to multiple CVEs; the text explains which…
CVE-2022-42334 — CVSS 6.5 (medium): x86/HVM pinned cache attributes mis-handling T[his CNA information record relates to multiple CVEs; the text explains which…
CVE-2020-15563 — CVSS 6.5 (medium): An issue was discovered in Xen through 4.13.x, allowing x86 HVM guest OS users to cause a hypervisor crash. An inverted conditional in x86…
CVE-2020-15566 — CVSS 6.5 (medium): An issue was discovered in Xen through 4.13.x, allowing guest OS users to cause a host OS crash because of incorrect error handling in…
CVE-2020-25597 — CVSS 6.5 (medium): An issue was discovered in Xen through 4.14.x. There is mishandling of the constraint that once-valid event channels may not turn invalid…
CVE-2020-29483 — CVSS 6.5 (medium): An issue was discovered in Xen through 4.14.x. Xenstored and guests communicate via a shared memory page using a specific protocol. When a…
CVE-2021-0089 — CVSS 6.5 (medium): Observable response discrepancy in some Intel(R) Processors may allow an authorized user to potentially enable information disclosure via…
CVE-2021-20257 — CVSS 6.5 (medium): An infinite loop flaw was found in the e1000 NIC emulator of the QEMU. This issue occurs while processing transmits (tx) descriptors in…
CVE-2021-28690 — CVSS 6.5 (medium): x86: TSX Async Abort protections not restored after S3 This issue relates to the TSX Async Abort speculative security vulnerability. Please…
CVE-2022-0001 — CVSS 6.5 (medium): Non-transparent sharing of branch predictor selectors between contexts in some Intel(R) Processors may allow an authorized user to…
CVE-2022-0002 — CVSS 6.5 (medium): Non-transparent sharing of branch predictor within a context in some Intel(R) Processors may allow an authorized user to potentially enable…
CVE-2022-23825 — CVSS 6.5 (medium): Aliases in the branch predictor may cause some AMD processors to predict the wrong branch type potentially leading to information…
CVE-2022-29900 — CVSS 6.5 (medium): Mis-trained branch predictions for return instructions may allow arbitrary speculative code execution under certain microarchitecture-depend…
CVE-2022-33746 — CVSS 6.5 (medium): P2M pool freeing may take excessively long The P2M pool backing second level address translation for guests may be of significant size…
CVE-2022-42311 — CVSS 6.5 (medium): Xenstore: guests can let run xenstored out of memory T[his CNA information record relates to multiple CVEs; the text explains which…
CVE-2022-42312 — CVSS 6.5 (medium): Xenstore: guests can let run xenstored out of memory T[his CNA information record relates to multiple CVEs; the text explains which…
CVE-2022-42313 — CVSS 6.5 (medium): Xenstore: guests can let run xenstored out of memory T[his CNA information record relates to multiple CVEs; the text explains which…
CVE-2022-42314 — CVSS 6.5 (medium): Xenstore: guests can let run xenstored out of memory T[his CNA information record relates to multiple CVEs; the text explains which…
CVE-2022-42315 — CVSS 6.5 (medium): Xenstore: guests can let run xenstored out of memory T[his CNA information record relates to multiple CVEs; the text explains which…
CVE-2022-42316 — CVSS 6.5 (medium): Xenstore: guests can let run xenstored out of memory T[his CNA information record relates to multiple CVEs; the text explains which…
CVE-2022-42317 — CVSS 6.5 (medium): Xenstore: guests can let run xenstored out of memory T[his CNA information record relates to multiple CVEs; the text explains which…
CVE-2022-42318 — CVSS 6.5 (medium): Xenstore: guests can let run xenstored out of memory T[his CNA information record relates to multiple CVEs; the text explains which…
CVE-2022-42319 — CVSS 6.5 (medium): Xenstore: Guests can cause Xenstore to not free temporary memory When working on a request of a guest, xenstored might need to allocate…
CVE-2022-42321 — CVSS 6.5 (medium): Xenstore: Guests can crash xenstored via exhausting the stack Xenstored is using recursion for some Xenstore operations (e.g. for deleting…
CVE-2022-26362 — CVSS 6.4 (medium): x86 pv: Race condition in typeref acquisition Xen maintains a type reference count for pages, in addition to a regular reference count…
CVE-2020-29570 — CVSS 6.2 (medium): An issue was discovered in Xen through 4.14.x. Recording of the per-vCPU control block mapping maintained by Xen and that of pointers into…
CVE-2020-29571 — CVSS 6.2 (medium): An issue was discovered in Xen through 4.14.x. A bounds check common to most operation time functions specific to FIFO event channels…
CVE-2020-25602 — CVSS 6.0 (medium): An issue was discovered in Xen through 4.14.x. An x86 PV guest can trigger a host OS crash when handling guest access to MSR_MISC_ENABLE…
CVE-2020-29484 — CVSS 6.0 (medium): An issue was discovered in Xen through 4.14.x. When a Xenstore watch fires, the xenstore client that registered the watch will receive a…
CVE-2020-8608 — CVSS 5.6 (medium): In libslirp 4.1.0, as used in QEMU 4.2.0, tcp_subr.c misuses snprintf return values, leading to a buffer overflow in later code.
CVE-2022-33748 — CVSS 5.6 (medium): lock order inversion in transitive grant copy handling As part of XSA-226 a missing cleanup call was inserted on an error handling path…
CVE-2022-26356 — CVSS 5.6 (medium): Racy interactions between dirty vram tracking and paging log dirty hypercalls Activation of log dirty mode done by XEN_DMOP_track_dirty_vram…
CVE-2021-20255 — CVSS 5.5 (medium): A stack overflow via an infinite recursion vulnerability was found in the eepro100 i8255x device emulator of QEMU. This issue occurs while…
CVE-2022-21166 — CVSS 5.5 (medium): Incomplete cleanup in specific special register write operations for some Intel(R) Processors may allow an authenticated user to…
CVE-2022-23034 — CVSS 5.5 (medium): A PV guest could DoS Xen while unmapping a grant To address XSA-380, reference counting was introduced for grant mappings for the case…
CVE-2022-23824 — CVSS 5.5 (medium): IBPB may not prevent return branch predictions from being specified by pre-IBPB branch targets leading to a potential information…
CVE-2022-42331 — CVSS 5.5 (medium): x86: speculative vulnerability in 32bit SYSCALL path Due to an oversight in the very original Spectre/Meltdown security work (XSA-254), one…
CVE-2020-29566 — CVSS 5.5 (medium): An issue was discovered in Xen through 4.14.x. When they require assistance from the device model, x86 HVM guests must be temporarily…
CVE-2020-27673 — CVSS 5.5 (medium): An issue was discovered in the Linux kernel through 5.9.1, as used with Xen through 4.14.x. Guest OS users can cause a denial of service…
CVE-2020-25600 — CVSS 5.5 (medium): An issue was discovered in Xen through 4.14.x. Out of bounds event channels are available to 32-bit x86 domains. The so called 2-level…
CVE-2020-25601 — CVSS 5.5 (medium): An issue was discovered in Xen through 4.14.x. There is a lack of preemption in evtchn_reset() / evtchn_destroy(). In particular, the FIFO…
CVE-2022-42322 — CVSS 5.5 (medium): Xenstore: Cooperating guests can create arbitrary numbers of nodes T[his CNA information record relates to multiple CVEs; the text explains…
CVE-2022-42323 — CVSS 5.5 (medium): Xenstore: Cooperating guests can create arbitrary numbers of nodes T[his CNA information record relates to multiple CVEs; the text explains…
CVE-2021-28699 — CVSS 5.5 (medium): inadequate grant-v2 status frames array bounds check The v2 grant table interface separates grant attributes from grant status. That is…
CVE-2021-28698 — CVSS 5.5 (medium): long running loops in grant table handling In order to properly monitor resource use, Xen maintains information on the grant mappings a…
CVE-2021-28689 — CVSS 5.5 (medium): x86: Speculative vulnerabilities with bare (non-shim) 32-bit PV guests 32-bit x86 PV guest kernels run in ring 1. At the time when Xen was…
CVE-2022-21125 — CVSS 5.5 (medium): Incomplete cleanup of microarchitectural fill buffers on some Intel(R) Processors may allow an authenticated user to potentially enable…
CVE-2021-3308 — CVSS 5.5 (medium): An issue was discovered in Xen 4.12.3 through 4.12.4 and 4.13.1 through 4.14.x. An x86 HVM guest with PCI pass through devices can force…
CVE-2022-42325 — CVSS 5.5 (medium): Xenstore: Guests can create arbitrary number of nodes via transactions T[his CNA information record relates to multiple CVEs; the text…
CVE-2022-42326 — CVSS 5.5 (medium): Xenstore: Guests can create arbitrary number of nodes via transactions T[his CNA information record relates to multiple CVEs; the text…
CVE-2022-21123 — CVSS 5.5 (medium): Incomplete cleanup of multi-core shared buffers for some Intel(R) Processors may allow an authenticated user to potentially enable…
CVE-2020-25596 — CVSS 5.5 (medium): An issue was discovered in Xen through 4.14.x. x86 PV guest kernels can experience denial of service via SYSENTER. The SYSENTER instruction…
CVE-2022-42310 — CVSS 5.5 (medium): Xenstore: Guests can create orphaned Xenstore nodes By creating multiple nodes inside a transaction resulting in an error, a malicious…
CVE-2020-27674 — CVSS 5.3 (medium): An issue was discovered in Xen through 4.14.x allowing x86 PV guest OS users to gain guest OS privileges by modifying kernel memory…
CVE-2020-14364 — CVSS 5.0 (medium): An out-of-bounds read/write access flaw was found in the USB emulator of the QEMU in versions before 5.2.0. This issue occurs while…
CVE-2020-25604 — CVSS 4.7 (medium): An issue was discovered in Xen through 4.14.x. There is a race condition when migrating timers between x86 HVM vCPUs. When migrating timers…
CVE-2022-23035 — CVSS 4.6 (medium): Insufficient cleanup of passed-through device IRQs The management of IRQs associated with physical devices exposed to x86 HVM guests…
CVE-2020-28368 — CVSS 4.4 (medium): Xen through 4.14.x allows guest OS administrators to obtain sensitive information (such as AES keys from outside the guest) via a…
CVE-2020-29130 — CVSS 4.3 (medium): slirp.c in libslirp through 4.3.1 has a buffer over-read because it tries to read a certain amount of header data even if that exceeds the…
CVE-2021-3595 — CVSS 3.8 (low): An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in the tftp_input()…
CVE-2021-3592 — CVSS 3.8 (low): An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in the bootp_input()…
CVE-2021-3594 — CVSS 3.8 (low): An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in the udp_input()…
CVE-2020-29480 — CVSS 2.3 (low): An issue was discovered in Xen through 4.14.x. Neither xenstore implementation does any permission checks when reporting a xenstore watch…
CVE-2022-23816: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none.