CVE-2013-2211
The libxenlight (libxl) toolstack library in Xen 4.0.x, 4.1.x, and 4.2.x uses weak permissions...
The libxenlight (libxl) toolstack library in Xen 4.0.x, 4.1.x, and 4.2.x uses weak permissions for xenstore keys for paravirtualised and emulated serial console devices, which allows local guest administrators to modify the xenstore value via unspecified vectors.
Exploit likelihood
What each source reports
NVD Score used
The libxenlight (libxl) toolstack library in Xen 4.0.x, 4.1.x, and 4.2.x uses weak permissions for xenstore keys for paravirtualised and emulated serial console devices, which allows local guest administrators to modify the xenstore value via unspecified vectors.
- Record
CVE-2013-2211- CVSS 2.0
- 7.4 High
AV:A/AC:M/Au:S/C:C/I:C/A:C - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
The libxenlight (libxl) toolstack library in Xen 4.0.x, 4.1.x, and 4.2.x uses weak permissions for xenstore keys for paravirtualised and emulated serial console devices, which allows local guest administrators to modify the xenstore value via unspecified vectors.
- Record
CVE-2013-2211- Updated
- 2026-11-02
EUVDEUVD-2013-2165 No score
The libxenlight (libxl) toolstack library in Xen 4.0.x, 4.1.x, and 4.2.x uses weak permissions for xenstore keys for paravirtualised and emulated serial console devices, which allows local guest administrators to modify the xenstore value via unspecified vectors.
- Record
EUVD-2013-2165- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-446j-5cq2-4x7c No score
The libxenlight (libxl) toolstack library in Xen 4.0.x, 4.1.x, and 4.2.x uses weak permissions...
The libxenlight (libxl) toolstack library in Xen 4.0.x, 4.1.x, and 4.2.x uses weak permissions for xenstore keys for paravirtualised and emulated serial console devices, which allows local guest administrators to modify the xenstore value via unspecified vectors.
- Record
GHSA-446j-5cq2-4x7c- Updated
- 2026-11-02
OSV No score
The libxenlight (libxl) toolstack library in Xen 4.0.x, 4.1.x, and 4.2.x uses weak permissions for xenstore keys for paravirtualised and emulated serial console devices, which allows local guest administrators to modify the xenstore value via unspecified vectors.
- Record
CVE-2013-2211- Updated
- 2026-11-02
OSVDEBIAN-CVE-2013-2211 No score
The libxenlight (libxl) toolstack library in Xen 4.0.x, 4.1.x, and 4.2.x uses weak permissions for xenstore keys for paravirtualised and emulated serial console devices, which allows local guest administrators to modify the xenstore value via unspecified vectors.
- Record
DEBIAN-CVE-2013-2211- Updated
- 2026-11-02
OSVMGASA-2013-0197 No score
Updated xen package fixes security issues
This update fixes the following security issues: XSA-52/CVE-2013-2076: Information leak on XSAVE/XRSTOR capable AMD CPUs XSA-53/CVE-2013-2077: Hypervisor crash due to missing exception recovery on XRSTOR XSA-54/CVE-2013-2078: Hypervisor crash due to missing exception recovery on XSETBV XSA-55/CVE-2013-2194: integer overflows XSA-55/CVE-2013-2195: pointer dereferences XSA-55/CVE-2013-2196: other problems XSA-56/CVE-2013-2072: Buffer overflow in xencontrol Python bindings affecting xend XSA-57/CVE-2013-2211: libxl allows guest write access to sensitive console related xenstore keys XSA-58/CVE-2013-1432: Page reference counting error due to XSA-45/CVE-2013-1918 fixes
- Record
MGASA-2013-0197- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
xenDebian:12 |
before 4.3.0-1 | 4.3.0-1 |
xenDebian:13 |
before 4.3.0-1 | 4.3.0-1 |
xenDebian:14 |
before 4.3.0-1 | 4.3.0-1 |
xenDebian:7 From an advisory covering 19 CVEs |
before 4.1.4-3+deb7u2, plus listed versions 4.1.4-34.1.4-3+deb7u1 |
4.1.4-3+deb7u2 |
xenMageia:3 From an advisory covering 9 CVEs |
before 4.2.1-16.2.mga3 | 4.2.1-16.2.mga3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-2211 is a high vulnerability (CVSS 7.4) in Xen, published July 1, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.56%, the 47th percentile. Fixed in xen 4.3.0-1.