Every CVE Search/ Get API key

CVE-2008-4405

xend in Xen 3.0.3 does not properly limit the contents of the /local/domain xenstore directory...

7.2 HighPublic exploit

xend in Xen 3.0.3 does not properly limit the contents of the /local/domain xenstore directory tree, and does not properly restrict a guest VM's write access within this tree, which allows guest OS users to cause a denial of service and possibly have unspecified other impact by writing to (1) console/tty, (2) console/limit, or (3) image/device-model-pid. NOTE: this issue was originally reported as an issue in libvirt 0.3.3 and xenstore, but CVE is considering the core issue to be related to Xen.

Exploit likelihood

1.04%Down 3.6 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 7.2

xend in Xen 3.0.3 does not properly limit the contents of the /local/domain xenstore directory tree, and does not properly restrict a guest VM's write access within this tree, which allows guest OS users to cause a denial of service and possibly have unspecified other impact by writing to (1) console/tty, (2) console/limit, or (3) image/device-model-pid. NOTE: this issue was originally reported as an issue in libvirt 0.3.3 and xenstore, but CVE is considering the core issue to be related to Xen.

Record
CVE-2008-4405
CVSS 2.0
7.2 HighAV:L/AC:L/Au:N/C:C/I:C/A:C
Weakness
CWE-264
Updated
2026-11-02
CVE List No score

xend in Xen 3.0.3 does not properly limit the contents of the /local/domain xenstore directory tree, and does not properly restrict a guest VM's write access within this tree, which allows guest OS users to cause a denial of service and possibly have unspecified other impact by writing to (1) console/tty, (2) console/limit, or (3) image/device-model-pid. NOTE: this issue was originally reported as an issue in libvirt 0.3.3 and xenstore, but CVE is considering the core issue to be related to Xen.

Record
CVE-2008-4405
Updated
2026-11-02
EUVDEUVD-2008-4386 No score

xend in Xen 3.0.3 does not properly limit the contents of the /local/domain xenstore directory tree, and does not properly restrict a guest VM's write access within this tree, which allows guest OS users to cause a denial of service and possibly have unspecified other impact by writing to (1) console/tty, (2) console/limit, or (3) image/device-model-pid. NOTE: this issue was originally reported as an issue in libvirt 0.3.3 and xenstore, but CVE is considering the core issue to be related to Xen.

Record
EUVD-2008-4386
Updated
2026-11-03
GitHub AdvisoriesGHSA-ffpp-v4vp-9vvh No score

xend in Xen 3.0.3 does not properly limit the contents of the /local/domain xenstore directory...

xend in Xen 3.0.3 does not properly limit the contents of the /local/domain xenstore directory tree, and does not properly restrict a guest VM's write access within this tree, which allows guest OS users to cause a denial of service and possibly have unspecified other impact by writing to (1) console/tty, (2) console/limit, or (3) image/device-model-pid. NOTE: this issue was originally reported as an issue in libvirt 0.3.3 and xenstore, but CVE is considering the core issue to be related to Xen.

Record
GHSA-ffpp-v4vp-9vvh
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
xen
Red Hat:rhel_virtualization:5::client
From an advisory covering 2 CVEs
 before 0:3.0.3-64.el5_2.9
0:3.0.3-64.el5_2.9
xen-debuginfo
Red Hat:rhel_virtualization:5::client
From an advisory covering 2 CVEs
 before 0:3.0.3-64.el5_2.9
0:3.0.3-64.el5_2.9
xen-devel
Red Hat:rhel_virtualization:5::client
From an advisory covering 2 CVEs
 before 0:3.0.3-64.el5_2.9
0:3.0.3-64.el5_2.9
xen
Red Hat:enterprise_linux:5::client
From an advisory covering 2 CVEs
 before 0:3.0.3-64.el5_2.9
0:3.0.3-64.el5_2.9
xen-debuginfo
Red Hat:enterprise_linux:5::client
From an advisory covering 2 CVEs
 before 0:3.0.3-64.el5_2.9
0:3.0.3-64.el5_2.9
xen-libs
Red Hat:enterprise_linux:5::client
From an advisory covering 2 CVEs
 before 0:3.0.3-64.el5_2.9
0:3.0.3-64.el5_2.9
xen
Red Hat:rhel_virtualization:5::server
From an advisory covering 2 CVEs
 before 0:3.0.3-64.el5_2.9
0:3.0.3-64.el5_2.9
xen-debuginfo
Red Hat:rhel_virtualization:5::server
From an advisory covering 2 CVEs
 before 0:3.0.3-64.el5_2.9
0:3.0.3-64.el5_2.9
xen-devel
Red Hat:rhel_virtualization:5::server
From an advisory covering 2 CVEs
 before 0:3.0.3-64.el5_2.9
0:3.0.3-64.el5_2.9
xen
Red Hat:enterprise_linux:5::server
From an advisory covering 2 CVEs
 before 0:3.0.3-64.el5_2.9
0:3.0.3-64.el5_2.9
xen-debuginfo
Red Hat:enterprise_linux:5::server
From an advisory covering 2 CVEs
 before 0:3.0.3-64.el5_2.9
0:3.0.3-64.el5_2.9
xen-libs
Red Hat:enterprise_linux:5::server
From an advisory covering 2 CVEs
 before 0:3.0.3-64.el5_2.9
0:3.0.3-64.el5_2.9

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
Exploit-DBXen 3.3 - XenStore Domain Configuration Data Unsafe Storage2008-09-30

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, Exploit-DB, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2008-4405 is a high vulnerability (CVSS 7.2) in Citrix Xen, published October 3, 2008. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 1.04%, the 64th percentile. No source names a fixed version.

References

Show 21 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open