Xen

CVE-2012-6035 Nov 23, 20:55 MEDIUM This Month

The do_tmem_destroy_pool function in the Transcendent Memory (TMEM) in Xen 4.0, 4.1, and 4.2 does not properly validate pool ids, which allows local guest OS users to cause a denial of service. Rated medium severity (CVSS 6.9). No vendor patch available.

CVE-2012-6034 Nov 23, 20:55 MEDIUM This Month

The (1) tmemc_save_get_next_page and (2) tmemc_save_get_next_inv functions and the (3) TMEMC_SAVE_GET_POOL_UUID sub-operation in the Transcendent Memory (TMEM) in Xen 4.0, 4.1, and 4.2 "do not check. Rated medium severity (CVSS 4.4). No vendor patch available.

CVE-2012-6033 Nov 23, 20:55 MEDIUM This Month

The do_tmem_control function in the Transcendent Memory (TMEM) in Xen 4.0, 4.1, and 4.2 does not properly check privileges, which allows local guest OS users to access control stack operations via. Rated medium severity (CVSS 4.4). No vendor patch available.

CVE-2012-6032 Nov 23, 20:55 MEDIUM This Month

Multiple integer overflows in the (1) tmh_copy_from_client and (2) tmh_copy_to_client functions in the Transcendent Memory (TMEM) in Xen 4.0, 4.1, and 4.2 allow local guest OS users to cause a denial. Rated medium severity (CVSS 4.9), this vulnerability is low attack complexity. No vendor patch available.

CVE-2012-6031 Nov 23, 20:55 MEDIUM This Month

The do_tmem_get function in the Transcendent Memory (TMEM) in Xen 4.0, 4.1, and 4.2 allow local guest OS users to cause a denial of service (CPU hang and host crash) via unspecified vectors related. Rated medium severity (CVSS 4.7). No vendor patch available.

CVE-2012-6030 Nov 23, 20:55 HIGH This Week

The do_tmem_op function in the Transcendent Memory (TMEM) in Xen 4.0, 4.1, and 4.2 allow local guest OS users to cause a denial of service (host crash) and possibly have other unspecified impacts via. Rated high severity (CVSS 7.2), this vulnerability is low attack complexity. No vendor patch available.

CVE-2012-4411 Nov 23, 20:55 MEDIUM This Month

The graphical console in Xen 4.0, 4.1 and 4.2 allows local OS guest administrators to obtain sensitive host resource information via the qemu monitor. Rated medium severity (CVSS 4.6), this vulnerability is low attack complexity. No vendor patch available.

CVE-2012-3516 Nov 23, 20:55 MEDIUM PATCH This Month

The GNTTABOP_swap_grant_ref sub-operation in the grant table hypercall in Xen 4.2 and Citrix XenServer 6.0.2 allows local guest kernels or administrators to cause a denial of service (host crash) and. Rated medium severity (CVSS 6.9).

CVE-2012-3515 Nov 23, 20:55 HIGH This Week

Qemu, as used in Xen 4.0, 4.1 and possibly other products, when emulating certain devices with a virtual console backend, allows local OS guest users to gain privileges via a crafted escape VT100. Rated high severity (CVSS 7.2), this vulnerability is low attack complexity. No vendor patch available.

CVE-2012-3498 Nov 23, 20:55 MEDIUM This Month

PHYSDEVOP_map_pirq in Xen 4.1 and 4.2 and Citrix XenServer 6.0.2 and earlier allows local HVM guest OS kernels to cause a denial of service (host crash) and possibly read hypervisor or guest memory. Rated medium severity (CVSS 5.6), this vulnerability is low attack complexity. No vendor patch available.

CVE-2012-3497 Nov 23, 20:55 MEDIUM This Month

(1) TMEMC_SAVE_GET_CLIENT_WEIGHT, (2) TMEMC_SAVE_GET_CLIENT_CAP, (3) TMEMC_SAVE_GET_CLIENT_FLAGS and (4) TMEMC_SAVE_END in the Transcendent Memory (TMEM) in Xen 4.0, 4.1, and 4.2 allow local guest OS. Rated medium severity (CVSS 6.9). No vendor patch available.

CVE-2012-3496 Nov 23, 20:55 MEDIUM PATCH This Month

XENMEM_populate_physmap in Xen 4.0, 4.1, and 4.2, and Citrix XenServer 6.0.2 and earlier, when translating paging mode is not used, allows local PV OS guest kernels to cause a denial of service (BUG. Rated medium severity (CVSS 4.7).

CVE-2012-3495 Nov 23, 20:55 MEDIUM This Month

The physdev_get_free_pirq hypercall in arch/x86/physdev.c in Xen 4.1.x and Citrix XenServer 6.0.2 and earlier uses the return value of the get_free_pirq function as an array index without checking. Rated medium severity (CVSS 6.1), this vulnerability is low attack complexity. No vendor patch available.

CVE-2012-3494 Nov 23, 20:55 LOW PATCH Monitor

The set_debugreg hypercall in include/asm-x86/debugreg.h in Xen 4.0, 4.1, and 4.2, and Citrix XenServer 6.0.2 and earlier, when running on x86-64 systems, allows local OS guest users to cause a. Rated low severity (CVSS 2.1), this vulnerability is low attack complexity.

CVE-2012-4539 Nov 21, 23:55 LOW Monitor

Xen 4.0 through 4.2, when running 32-bit x86 PV guests on 64-bit hypervisors, allows local guest OS administrators to cause a denial of service (infinite loop and hang or crash) via invalid arguments. Rated low severity (CVSS 2.1), this vulnerability is low attack complexity. No vendor patch available.

CVE-2012-4537 Nov 21, 23:55 LOW Monitor

Xen 3.4 through 4.2, and possibly earlier versions, does not properly synchronize the p2m and m2p tables when the set_p2m_entry function fails, which allows local HVM guest OS administrators to cause. Rated low severity (CVSS 2.1), this vulnerability is low attack complexity. No vendor patch available.

CVE-2012-4536 Nov 21, 23:55 LOW Monitor

The (1) domain_pirq_to_emuirq and (2) physdev_unmap_pirq functions in Xen 2.2 allows local guest OS administrators to cause a denial of service (Xen crash) via a crafted pirq value that triggers an. Rated low severity (CVSS 2.1), this vulnerability is low attack complexity. No vendor patch available.

CVE-2012-4535 Nov 21, 23:55 LOW Monitor

Xen 3.4 through 4.2, and possibly earlier versions, allows local guest OS administrators to cause a denial of service (Xen infinite loop and physical CPU consumption) by setting a VCPU with an. Rated low severity (CVSS 1.9). No vendor patch available.

CVE-2012-4544 Oct 31, 16:55 LOW Monitor

The PV domain builder in Xen 4.2 and earlier does not validate the size of the kernel or ramdisk (1) before or (2) after decompression, which allows local guest administrators to cause a denial of. Rated low severity (CVSS 2.1), this vulnerability is low attack complexity. No vendor patch available.

CVE-2012-2625 Oct 31, 16:55 LOW Monitor

The PyGrub boot loader in Xen unstable before changeset 25589:60f09d1ab1fe, 4.2.x, and 4.1.x allows local para-virtualized guest users to cause a denial of service (memory consumption) via a large. Rated low severity (CVSS 2.7), this vulnerability is low attack complexity. No vendor patch available.

CVE-2025-58147 May 27, 22:00 HIGH PATCH This Week

Out-of-bounds read in the Xen hypervisor (CVE-2025-58147) can let an attacker who controls or runs code inside a guest VM on an affected host read hypervisor memory, exposing confidential data. Exploitation is assessed as local, high-complexity, and requiring low privileges (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N), with confidentiality-only impact; the supplied remote unauthenticated 7.5 score is not corroborated. No public exploit identified at time of analysis, EPSS is low at 0.36% (28th percentile), and Alpine has released a fix in xen 4.20.1-r2 per XSA-475.

CVE-2025-58148 May 27, 22:00 HIGH PATCH This Week

Information disclosure in Xen hypervisor (XSA-475) allows an attacker who already controls a guest domain to trigger a hypervisor-level out-of-bounds read, potentially exposing sensitive host memory contents. Affected deployments include Alpine Linux builds shipping Xen before 4.20.1-r2; the vendor fix is available in xen 4.20.1-r2. Exploitation requires guest execution on the vulnerable host rather than external network reachability, despite the network-oriented CVSS vector in some feeds, and no public exploit code was identified at time of analysis (EPSS 0.36%).

CVE-2025-58149 May 27, 22:00 HIGH PATCH This Week

Information disclosure in Alpine Linux's Xen package before 4.20.1-r2 can expose sensitive host memory to an attacker who controls or has compromised a guest domain. The underlying issue is a use-after-expiration/release condition (CWE-672) reached through guest execution; assessed impact is confidentiality only with scope changed, and exploitation requires local guest privileges rather than the unauthenticated network vector shown by NVD. Vendor-released patch: Alpine Xen 4.20.1-r2; no public exploit identified at time of analysis, and EPSS is low at 0.40% (34th percentile).