📦 Xen

CVE-2025-58143 is a race condition vulnerability in Xen's viridian code that allows a malicious guest VM to cause Xen to free a memory page while it's still mapped in guest physical-to-machine page ta...

Multiple vulnerabilities in Xen's viridian code allow attackers to cause denial of service or potentially execute arbitrary code through NULL pointer dereferences and race conditions in guest memory p...

This CVE describes an out-of-bounds write vulnerability in Xen's shadow mode tracing code where guest-controlled data can be written beyond allocated per-CPU variable boundaries. This allows a malicio...

This Xen hypervisor vulnerability allows a guest domain to retain access to 64-bit memory BARs (Base Address Registers) after PCI device detachment, creating a permission leak. PV domains can directly...

This vulnerability involves boundary checking bugs in Xen's handling of Viridian hypercalls, allowing out-of-bounds reads and writes. Attackers could potentially crash the hypervisor, execute arbitrar...

CVE-2025-58145 is a race condition vulnerability in Xen hypervisor's page table management where the P2M lock isn't properly held during page reference operations. This allows a malicious guest domain...

This vulnerability is a deadlock condition in Xen's interrupt remapping code for legacy PCI(-X) devices. When exploited, it can cause system instability or denial of service. It affects Xen hypervisor...

This CVE describes a vulnerability in Xen hypervisor's memory mapping logic for PCI devices with Reserved Memory Regions (RMRR) or Unity Mapping ranges. When error handling fails during device deactiv...

This vulnerability in Xen's x86 APIC implementation allows a malicious guest VM to trigger a deadlock in the hypervisor by configuring error interrupts with illegal vectors. This causes recursive lock...

This CVE-2024-31142 vulnerability involves a logical error in Xen's XSA-407 mitigation for Branch Type Confusion, causing the protection to not apply properly when intended. The same infrastructure fl...

This Xen hypervisor vulnerability allows a malicious PV guest to crash the host system by exploiting a race condition in shadow paging memory management. When the hypervisor tears down shadow page tab...

CVE-2023-34325 is a stack buffer overflow vulnerability in Xen's libfsimage library, derived from old grub-legacy code. Attackers with access to guest disks can exploit this to execute arbitrary code ...

The AdSanity WordPress plugin up to version 1.8.1 contains a vulnerability that allows authenticated users with Contributor-level permissions or higher to upload arbitrary files to the server. This ca...

This CVE describes a use-after-free vulnerability in Xen's shadow mode with log-dirty mode enabled. It allows a malicious guest VM to crash the hypervisor or potentially execute arbitrary code on the ...

This CVE describes a race condition vulnerability in Xen's VT-d (Virtualization Technology for Directed I/O) domain ID cleanup mechanism. It allows attackers to bypass DMA (Direct Memory Access) flush...

This vulnerability affects systems with Intel VT-d or AMD-Vi IOMMU technology when certain PCI devices use reserved memory regions. It allows DMA or interrupts from affected devices to cause unpredict...

This vulnerability affects systems using Intel VT-d or AMD-Vi IOMMU technologies where PCI devices have Reserved Memory Regions (RMRR) or Unity Mapping ranges. When these memory mappings become inacce...

Multiple race condition vulnerabilities in Linux PV device frontends allow malicious Xen backends to maintain unauthorized access to guest memory pages. This can lead to data leaks, data corruption, a...

This CVE (CVE-2022-23038) is part of a series of vulnerabilities affecting Linux PV device frontends in Xen virtualization. It allows malicious or compromised backends to maintain unauthorized access ...

Multiple race condition vulnerabilities in Linux PV device frontends allow malicious Xen backends to maintain unauthorized access to guest memory pages. This can lead to data leaks, data corruption, a...

CVE-2022-23042 is a race condition vulnerability in Linux Xen PV netfront driver where a malicious backend can trigger a BUG_ON() assertion failure, causing a denial of service (DoS) to the guest VM. ...

This Xen hypervisor vulnerability on ARM systems allows guest virtual machines to retain access to memory pages after returning them to Xen, potentially enabling information disclosure or privilege es...

This Xen hypervisor vulnerability allows guest virtual machines to retain access to memory pages after they've been deallocated and potentially reused. When a guest switches from grant table v2 to v1,...

This vulnerability in Xen hypervisor allows x86 HVM and PVH guests to cause memory corruption through improper error handling in partially successful P2M (Page-to-Machine) updates. Attackers with gues...

CVE-2021-28706 is an integer overflow vulnerability in Xen hypervisor memory management that allows virtual machine guests to exceed their allocated memory limits. When guests are configured with near...

This vulnerability in Xen hypervisor allows x86 HVM and PVH guests to crash the host system through misaligned page operations in populate-on-demand mode. Specifically, XENMEM_decrease_reservation hyp...

This vulnerability in Xen's VT-d IOMMU implementation allows a guest virtual machine to write to leaf page table entries when sharing page tables with CPUs. This occurs because Xen fails to properly s...

This vulnerability allows PCI devices with Reserved Memory Region Reporting (RMRR) to be improperly deassigned when passed through to virtual machine guests. On guest shutdown, the IOMMU configuration...

CVE-2021-28701 is a race condition vulnerability in Xen's grant table v2 status page handling that allows guest VMs to retain access to freed memory pages. This affects Xen hypervisor systems running ...

This Xen hypervisor vulnerability allows guest virtual machines to retain access to freed memory pages after switching from grant table v2 to v1. A race condition during mapping requests can cause pag...

This CVE describes a deadlock vulnerability in the Xen hypervisor's VGA memory access acceleration code for HVM guests. When emulating certain instructions with two VGA memory accesses, the hypervisor...

A Xen hypervisor vulnerability where HVM guests can set register values outside expected ranges during hypercall continuations, triggering a hypervisor crash. This affects Xen-based virtualization env...

This Xen hypervisor vulnerability allows indirect branch predictor poisoning between guest tasks, breaking kernel-level isolation. It affects Xen-based virtualization environments where multiple guest...