{"id":"CVE-2016-4963","aliases":["DEBIAN-CVE-2016-4963","DLA-1493-1","EUVD-2016-5937","GHSA-4wh7-gxf5-7gc2","MGASA-2017-0012","SUSE-SU-2016:2093-1","SUSE-SU-2016:2100-1","SUSE-SU-2016:2533-1","UBUNTU-CVE-2016-4963"],"status":"published","title":"The libxl device-handling in Xen through 4.6.x allows local guest OS users with access to the...","description":"The libxl device-handling in Xen through 4.6.x allows local guest OS users with access to the driver domain to cause a denial of service (management tool confusion) by manipulating information in the backend directories in xenstore.","severity":{"version":"3.0","score":4.7,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-06","score":0.00297,"percentile":0.22485,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-284"],"published":"2016-06-07T14:00:00Z","modified":"2026-09-22T07:01:03Z","fixes":[{"ecosystem":"Debian:12","package":"xen","fixed_in":["4.8.0~rc3-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"xen","fixed_in":["4.8.0~rc3-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"xen","fixed_in":["4.8.0~rc3-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"xen","fixed_in":["4.4.2-0ubuntu0.14.04.6"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"xen","fixed_in":["4.6.0-1ubuntu4.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.0~rc3-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.0~rc3-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.0~rc3-1"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.4lts1-0+deb8u1"}]}],"versions":["4.4.1-9","4.4.1-9+deb8u1","4.4.1-9+deb8u10","4.4.1-9+deb8u2","4.4.1-9+deb8u3","4.4.1-9+deb8u4","4.4.1-9+deb8u5","4.4.1-9+deb8u6","4.4.1-9+deb8u7","4.4.1-9+deb8u8","4.4.1-9+deb8u9"],"bundled":2},{"source":"osv","ecosystem":"Mageia:5","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.5-1.1.mga5"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP1","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.3_08-17.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP1","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.3_08-17.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.3_08-17.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.3_08-17.1"}]}],"bundled":27},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.4_07-37.1"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.4_07-37.1"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.4_07-37.1"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.4_04-22.22.2"}]}],"bundled":38},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12-LTSS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.4_04-22.22.2"}]}],"bundled":38},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.2-0ubuntu0.14.04.6"}]}],"versions":["4.3.0-1ubuntu1","4.3.0-1ubuntu2","4.3.0-1ubuntu3","4.3.0-1ubuntu4","4.3.0-1ubuntu5","4.4.0-0ubuntu3","4.4.0-0ubuntu4","4.4.0-0ubuntu5","4.4.0-0ubuntu5.1","4.4.0-0ubuntu5.2","4.4.1-0ubuntu0.14.04.1","4.4.1-0ubuntu0.14.04.2","4.4.1-0ubuntu0.14.04.3","4.4.1-0ubuntu0.14.04.4","4.4.1-0ubuntu0.14.04.5","4.4.1-0ubuntu0.14.04.6","4.4.2-0ubuntu0.14.04.1","4.4.2-0ubuntu0.14.04.2","4.4.2-0ubuntu0.14.04.3","4.4.2-0ubuntu0.14.04.4","4.4.2-0ubuntu0.14.04.5"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.0-1ubuntu4.1"}]}],"versions":["4.5.1-0ubuntu1","4.5.1-0ubuntu2","4.6.0-1ubuntu1","4.6.0-1ubuntu2","4.6.0-1ubuntu4"]}],"products":[{"vendor":"xen","product":"xen"}],"references":[{"url":"https://lists.debian.org/debian-lts-announce/2018/09/msg00006.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://www.securitytracker.com/id/1036024","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","web"]},{"url":"http://xenbits.xen.org/xsa/advisory-178.html","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-4963"},{"url":"https://github.com/advisories/GHSA-4wh7-gxf5-7gc2"},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-4963","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2017-0012.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=19901","tags":["report"]},{"url":"https://www.xenproject.org/downloads/xen-archives/xen-45-series/xen-453.html","tags":["web"]},{"url":"https://www.xenproject.org/downloads/xen-archives/xen-45-series/xen-455.html","tags":["web"]},{"url":"https://xenbits.xen.org/xsa/advisory-172.html","tags":["advisory"]},{"url":"https://xenbits.xen.org/xsa/advisory-173.html","tags":["advisory"]},{"url":"https://xenbits.xen.org/xsa/advisory-175.html","tags":["advisory"]},{"url":"https://xenbits.xen.org/xsa/advisory-176.html","tags":["advisory"]},{"url":"https://xenbits.xen.org/xsa/advisory-178.html","tags":["advisory"]},{"url":"https://xenbits.xen.org/xsa/advisory-179.html","tags":["advisory"]},{"url":"https://xenbits.xen.org/xsa/advisory-180.html","tags":["advisory"]},{"url":"https://xenbits.xen.org/xsa/advisory-181.html","tags":["advisory"]},{"url":"https://xenbits.xen.org/xsa/advisory-182.html","tags":["advisory"]},{"url":"https://xenbits.xen.org/xsa/advisory-183.html","tags":["advisory"]},{"url":"https://xenbits.xen.org/xsa/advisory-184.html","tags":["advisory"]},{"url":"https://xenbits.xen.org/xsa/advisory-185.html","tags":["advisory"]},{"url":"https://xenbits.xen.org/xsa/advisory-186.html","tags":["advisory"]},{"url":"https://xenbits.xen.org/xsa/advisory-187.html","tags":["advisory"]},{"url":"https://xenbits.xen.org/xsa/advisory-190.html","tags":["advisory"]},{"url":"https://xenbits.xen.org/xsa/advisory-191.html","tags":["advisory"]},{"url":"https://xenbits.xen.org/xsa/advisory-192.html","tags":["advisory"]},{"url":"https://xenbits.xen.org/xsa/advisory-193.html","tags":["advisory"]},{"url":"https://xenbits.xen.org/xsa/advisory-194.html","tags":["advisory"]},{"url":"https://xenbits.xen.org/xsa/advisory-195.html","tags":["advisory"]},{"url":"https://xenbits.xen.org/xsa/advisory-196.html","tags":["advisory"]},{"url":"https://xenbits.xen.org/xsa/advisory-197.html","tags":["advisory"]},{"url":"https://xenbits.xen.org/xsa/advisory-198.html","tags":["advisory"]},{"url":"https://xenbits.xen.org/xsa/advisory-199.html","tags":["advisory"]},{"url":"https://xenbits.xen.org/xsa/advisory-200.html","tags":["advisory"]},{"url":"https://xenbits.xen.org/xsa/advisory-202.html","tags":["advisory"]},{"url":"https://xenbits.xen.org/xsa/advisory-204.html","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20162093-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/900418","tags":["report"]},{"url":"https://bugzilla.suse.com/949889","tags":["report"]},{"url":"https://bugzilla.suse.com/953339","tags":["report"]},{"url":"https://bugzilla.suse.com/953362","tags":["report"]},{"url":"https://bugzilla.suse.com/953518","tags":["report"]},{"url":"https://bugzilla.suse.com/954872","tags":["report"]},{"url":"https://bugzilla.suse.com/957986","tags":["report"]},{"url":"https://bugzilla.suse.com/958848","tags":["report"]},{"url":"https://bugzilla.suse.com/961600","tags":["report"]},{"url":"https://bugzilla.suse.com/963161","tags":["report"]},{"url":"https://bugzilla.suse.com/964427","tags":["report"]},{"url":"https://bugzilla.suse.com/973188","tags":["report"]},{"url":"https://bugzilla.suse.com/973631","tags":["report"]},{"url":"https://bugzilla.suse.com/974038","tags":["report"]},{"url":"https://bugzilla.suse.com/975130","tags":["report"]},{"url":"https://bugzilla.suse.com/975138","tags":["report"]},{"url":"https://bugzilla.suse.com/975907","tags":["report"]},{"url":"https://bugzilla.suse.com/976058","tags":["report"]},{"url":"https://bugzilla.suse.com/976111","tags":["report"]},{"url":"https://bugzilla.suse.com/978164","tags":["report"]},{"url":"https://bugzilla.suse.com/978295","tags":["report"]},{"url":"https://bugzilla.suse.com/978413","tags":["report"]},{"url":"https://bugzilla.suse.com/979620","tags":["report"]},{"url":"https://bugzilla.suse.com/979670","tags":["report"]},{"url":"https://bugzilla.suse.com/980716","tags":["report"]},{"url":"https://bugzilla.suse.com/980724","tags":["report"]},{"url":"https://bugzilla.suse.com/981264","tags":["report"]},{"url":"https://bugzilla.suse.com/981276","tags":["report"]},{"url":"https://bugzilla.suse.com/982024","tags":["report"]},{"url":"https://bugzilla.suse.com/982025","tags":["report"]},{"url":"https://bugzilla.suse.com/982026","tags":["report"]},{"url":"https://bugzilla.suse.com/982224","tags":["report"]},{"url":"https://bugzilla.suse.com/982225","tags":["report"]},{"url":"https://bugzilla.suse.com/982286","tags":["report"]},{"url":"https://bugzilla.suse.com/982695","tags":["report"]},{"url":"https://bugzilla.suse.com/982960","tags":["report"]},{"url":"https://bugzilla.suse.com/983973","tags":["report"]},{"url":"https://bugzilla.suse.com/983984","tags":["report"]},{"url":"https://bugzilla.suse.com/984981","tags":["report"]},{"url":"https://bugzilla.suse.com/985503","tags":["report"]},{"url":"https://bugzilla.suse.com/986586","tags":["report"]},{"url":"https://bugzilla.suse.com/988675","tags":["report"]},{"url":"https://bugzilla.suse.com/988676","tags":["report"]},{"url":"https://bugzilla.suse.com/990843","tags":["report"]},{"url":"https://bugzilla.suse.com/990923","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3672","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3158","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3159","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3710","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3960","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4001","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4002","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4020","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4037","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4439","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4441","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4453","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4454","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4952","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4962","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4963","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5105","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5106","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5107","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5126","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5238","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5337","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5338","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5403","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6258","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6259","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6351","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20162100-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/955399","tags":["report"]},{"url":"https://bugzilla.suse.com/967630","tags":["report"]},{"url":"https://bugzilla.suse.com/974912","tags":["report"]},{"url":"https://bugzilla.suse.com/979035","tags":["report"]},{"url":"https://bugzilla.suse.com/989235","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20162533-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/970135","tags":["report"]},{"url":"https://bugzilla.suse.com/971949","tags":["report"]},{"url":"https://bugzilla.suse.com/990970","tags":["report"]},{"url":"https://bugzilla.suse.com/991934","tags":["report"]},{"url":"https://bugzilla.suse.com/992224","tags":["report"]},{"url":"https://bugzilla.suse.com/994421","tags":["report"]},{"url":"https://bugzilla.suse.com/994625","tags":["report"]},{"url":"https://bugzilla.suse.com/994761","tags":["report"]},{"url":"https://bugzilla.suse.com/994772","tags":["report"]},{"url":"https://bugzilla.suse.com/994775","tags":["report"]},{"url":"https://bugzilla.suse.com/995785","tags":["report"]},{"url":"https://bugzilla.suse.com/995789","tags":["report"]},{"url":"https://bugzilla.suse.com/995792","tags":["report"]},{"url":"https://bugzilla.suse.com/997731","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3615","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3712","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4480","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6833","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6834","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6835","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6836","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6888","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7092","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7093","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7094","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7154","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2016-4963","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-4963","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2016-4963","description":"The libxl device-handling in Xen through 4.6.x allows local guest OS users with access to the driver domain to cause a denial of service (management tool confusion) by manipulating information in the backend directories in xenstore.","status":"published","published":"2016-06-07T14:00:00Z","modified":"2024-08-06T00:46:40.035Z","updated_at":"2026-11-02T14:33:34.815789Z"}],"euvd":[{"id":"EUVD-2016-5937","description":"The libxl device-handling in Xen through 4.6.x allows local guest OS users with access to the driver domain to cause a denial of service (management tool confusion) by manipulating information in the backend directories in xenstore.","status":"published","published":"2016-06-07T14:00:00Z","modified":"2024-08-06T00:46:40Z","updated_at":"2026-11-03T02:22:44.489595Z"}],"ghsa":[{"id":"GHSA-4wh7-gxf5-7gc2","title":"The libxl device-handling in Xen through 4.6.x allows local guest OS users with access to the...","description":"The libxl device-handling in Xen through 4.6.x allows local guest OS users with access to the driver domain to cause a denial of service (management tool confusion) by manipulating information in the backend directories in xenstore.","status":"published","published":"2022-05-14T03:00:35Z","modified":"2023-02-02T05:07:23Z","cvss":[{"version":"3.0","score":4.7,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:52:29.522501Z"}],"nvd":[{"id":"CVE-2016-4963","description":"The libxl device-handling in Xen through 4.6.x allows local guest OS users with access to the driver domain to cause a denial of service (management tool confusion) by manipulating information in the backend directories in xenstore.","status":"published","published":"2016-06-07T14:06:16.183Z","modified":"2026-06-17T00:48:30.857Z","cvss":[{"version":"3.0","score":4.7,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":1.9,"vector":"AV:L/AC:M/Au:N/C:N/I:N/A:P","level":"low","assessor":"primary"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:03:26.642445Z"}],"osv":[{"id":"CVE-2016-4963","description":"The libxl device-handling in Xen through 4.6.x allows local guest OS users with access to the driver domain to cause a denial of service (management tool confusion) by manipulating information in the backend directories in xenstore.","status":"published","published":"2016-06-07T14:06:16.183Z","modified":"2026-04-16T06:21:24.360403736Z","cvss":[{"version":"3.0","score":4.7,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:02.454775Z"},{"id":"DEBIAN-CVE-2016-4963","description":"The libxl device-handling in Xen through 4.6.x allows local guest OS users with access to the driver domain to cause a denial of service (management tool confusion) by manipulating information in the backend directories in xenstore.","status":"published","published":"2016-06-07T14:06:16.183Z","modified":"2026-09-22T07:01:03.904326125Z","cvss":[{"version":"3.0","score":4.7,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:27.627285Z"},{"id":"UBUNTU-CVE-2016-4963","description":"The libxl device-handling in Xen through 4.6.x allows local guest OS users with access to the driver domain to cause a denial of service (management tool confusion) by manipulating information in the backend directories in xenstore.","status":"published","published":"2016-06-07T14:06:00Z","modified":"2026-04-22T10:46:48.179929Z","cvss":[{"version":"3.0","score":4.7,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:12.261906Z"},{"id":"DLA-1493-1","title":"xen - security update","status":"published","published":"2018-09-05T00:00:00Z","modified":"2026-03-09T01:22:12.041332Z","updated_at":"2026-11-02T15:46:09.777694Z"},{"id":"MGASA-2017-0012","title":"Updated xen packages fix security vulnerability","description":"This xen update is based on upstream 4.5.5 maintenance release, and fixes\nthe following security issues:\n\nThe qemu implementation in libvirt before 1.3.0 and Xen allows local guest\nOS users to cause a denial of service (host disk consumption) by writing\nto stdout or stderr (CVE-2014-3672)\n\nThe xrstor function in arch/x86/xstate.c in Xen 4.x does not properly handle\nwrites to the hardware FSW.ES bit when running on AMD64 processors, which\nallows local guest OS users to obtain sensitive register content information\nfrom another guest by leveraging pending exception and mask bits. NOTE: this\nvulnerability exists because of an incorrect fix for CVE-2013-2076\n(CVE-2016-3158).\n\nThe fpu_fxrstor function in arch/x86/i387.c in Xen 4.x does not properly\nhandle writes to the hardware FSW.ES bit when running on AMD64 processors,\nwhich allows local guest OS users to obtain sensitive register content\ninformation from another guest by leveraging pending exception and mask\nbits. NOTE: this vulnerability exists because of an incorrect fix for\nCVE-2013-2076 (CVE-2016-3159).\n\nThe VGA module in QEMU improperly performs bounds checking on banked access\nto video memory, which allows local guest OS administrators to execute\narbitrary code on the host by changing access modes after setting the bank\nregister, aka the \"Dark Portal\" issue (CVE-2016-3710).\n\nInteger overflow in the VGA module in QEMU allows local guest OS users to\ncause a denial of service (out-of-bounds read and QEMU process crash) by\nediting VGA registers in VBE mode (CVE-2016-3712).\n\nInteger overflow in the x86 shadow pagetable code in Xen allows local guest\nOS users to cause a denial of service (host crash) or possibly gain\nprivileges by shadowing a superpage mapping (CVE-2016-3960).\n\nThe libxl device-handling in Xen 4.6.x and earlier allows local OS guest\nadministrators to cause a denial of service (resource consumption or\nmanagement facility confusion) or gain host OS privileges by manipulating\ninformation in guest controlled areas of xenstore (CVE-2016-4962).\n\nThe libxl device-handling in Xen through 4.6.x allows local guest OS users\nwith access to the driver domain to cause a denial of service (management\ntool confusion) by manipulating information in the backend directories in\nxenstore (CVE-2016-4963).\n\nThe guest_walk_tables function in arch/x86/mm/guest_walk.c in Xen 4.6.x and\nearlier does not properly handle the Page Size (PS) page table entry bit at\nthe L4 and L3 page table levels, which might allow local guest OS users to\ngain privileges via a crafted mapping of memory (CVE-2016-4480).\n\nThe p2m_teardown function in arch/arm/p2m.c in Xen 4.4.x through 4.6.x allows\nlocal guest OS users with access to the driver domain to cause a denial of\nservice (NULL pointer dereference and host OS crash) by creating concurrent\ndomains and holding references to them, related to VMID exhaustion\n(CVE-2016-5242).\n\nThe virtqueue_pop function in hw/virtio/virtio.c in QEMU allows local guest\nOS administrators to cause a denial of service (memory consumption and QEMU\nprocess crash) by submitting requests without waiting for completion\n(CVE-2016-5403).\n\nThe PV pagetable code in arch/x86/mm.c in Xen 4.7.x and earlier allows local\n32-bit PV guest OS administrators to gain host OS privileges by leveraging\nfast-paths for updating pagetable entries (CVE-2016-6258).\n\nXen 4.5.x through 4.7.x do not implement Supervisor Mode Access Prevention\n(SMAP) whitelisting in 32-bit exception and event delivery, which allows\nlocal 32-bit PV guest OS kernels to cause a denial of service (hypervisor\nand VM crash) by triggering a safety check (CVE-2016-6259).\n\nThe get_page_from_l3e function in arch/x86/mm.c in Xen allows local 32-bit\nPV guest OS administrators to gain host OS privileges via vectors related\nto L3 recursive pagetables (CVE-2016-7092).\n\nXen 4.5.3, 4.6.3, and 4.7.x allow local HVM guest OS administrators to\noverwrite hypervisor memory and consequently gain host OS privileges by\nleveraging mishandling of instruction pointer truncation during emulation\n(CVE-2016-7093).\n\nBuffer overflow in Xen 4.7.x and earlier allows local x86 HVM guest OS\nadministrators on guests running with shadow paging to cause a denial of\nservice via a pagetable update (CVE-2016-7094).\n\nXen 4.7.x and earlier does not properly honor CR0.TS and CR0.EM, which\nallows local x86 HVM guest OS users to read or modify FPU, MMX, or XMM\nregister state information belonging to arbitrary tasks on the guest by\nmodifying an instruction while the hypervisor is preparing to emulate it\n(CVE-2016-7777).\n\nWhen Xen emulates instructions which generate software interrupts it needs\nto perform a privilege check involving an IDT lookup. This check is sometimes\nerroneously conducted as if the IDT had the format for a 32-bit guest, when\nin fact it is in the 64-bit format. Xen will then read the wrong part of the\nIDT and interpret it in an unintended manner. An unprivileged guest user\nprogram may be able to crash the guest (CVE-2016-9377).\n\nWhen Xen emulates instructions which generate software interrupts, and\nchooses to deliver the software interrupt, it may try to use the method\nintended for injecting exceptions. This is incorrect, and results in a\nguest crash (CVE-2016-9378).\n\npygrub supports a number of output formats. When the S-expression output\nformat is requested, putting string quotes and S-expressions in the \nbootloader configuration file can produce incorrect output. A malicious\nguest administrator can obtain the contents of sensitive host files (an\ninformation leak), or can cause files on the host to be removed, causing\na denial of service or in unusual cases privilegie escalation (CVE-2016-9379).\n\nWhen the nul-delimited output format is requested, nul bytes in the\nbootloader configuration file can produce an ambiguous or confusing output\nfile, which is interpreted by libxl in a vulnerable way. A malicious guest\nadministrator can obtain the contents of sensitive host files (an information\nleak), or can cause files on the host to be removed, causing a denial of\nservice or in unusual cases privilegie escalation (CVE-2016-9380).\n\nThe compiler can emit optimizations in qemu which can lead to double fetch\nvulnerabilities. Specifically data on the rings shared between qemu and the\nhypervisor (which the guest under control can obtain mappings of) can be\nfetched twice (during which time the guest can alter the contents) possibly\nleading to arbitrary code execution in qemu. Malicious administrators can\nexploit this vulnerability to take over the qemu process, elevating its\nprivilege to that of the qemu process. In a system not using a device model\nstub domain (or other techniques for deprivileging qemu), malicious guest\nadministrators can thus elevate their privilege to that of the host\n(CVE-2016-9381).\n\nLDTR, just like TR, is purely a protected mode facility. Hence even when\nswitching to a VM86 mode task, LDTR loading needs to follow protected mode\nsemantics. This was violated by the code. On SVM (AMD hardware): a malicious\nunprivileged guest process can escalate its privilege to that of the guest\noperating system. On both SVM and VMX (Intel hardware): a malicious\nunprivileged guest process can crash the guest (CVE-2016-9382).\n\nThe x86 instructions BT, BTC, BTR, and BTS, when used with a destination\nmemory operand and a source register rather than an immediate operand,\naccess a memory location offset from that specified by the memory operand\nas specified by the high bits of the register source. When Xen needs to\nemulate such an instruction, to efficiently handle the emulation, the memory\naddress and register operand are recalculated internally to Xen. In this\nprocess, the high bits of an intermediate expression were discarded, leading\nto both the memory location and the register operand being wrong. A malicious\nguest can modify arbitrary memory, allowing for arbitrary code execution\n(and therefore privilege escalation affecting the whole host), a crash of\nthe host (leading to a DoS), or information leaks (CVE-2016-9383).\n\nAlong with their main kernel binary, unprivileged guests may arrange to \nhave their Xen environment load (kernel) symbol tables for their use.\nThe ELF image metadata created for this purpose has a few unused bytes\nwhen the symbol table binary is in 32-bit ELF format. These unused bytes\nwere not properly cleared during symbol table loading. A malicious\nunprivileged guest may be able to obtain sensitive information from the\nhost (CVE-2016-9384).\n\nBoth writes to the FS and GS register base MSRs as well as the WRFSBASE and\nWRGSBASE instructions require their input values to be canonical, or a #GP\nfault will be raised. When the use of those instructions by the hypervisor\nwas enabled, the previous guard against #GP faults (having recovery code\nattached) was accidentally removed. A malicious guest administrator can\ncrash the host, leading to a DoS (CVE-2016-9385).\n\nThe Xen x86 emulator erroneously failed to consider the unusability of\nsegments when performing memory accesses. An unprivileged guest user\nprogram may be able to elevate its privilege to that of the guest operating\nsystem (CVE-2016-9386).\n\nThe code in qemu which implements ioport read/write looks up the specified\nioport address in a 32-bit dispatch table without proper range checks.\nXen will write only 16-bit address ioport accesses. However, depending on\nthe Xen and qemu version, the ring may be writeable by the guest. If so,\nthe guest can generate out-of-range ioport accesses, resulting in wild\npointer accesses within qemu. A malicious guest administrator can escalate\ntheir privilege to that of the host (CVE-2016-9637).\n\nx86 CMPXCHG8B emulation fails to ignore operand size override. A malicious\nunprivileged guest may be able to obtain sensitive information from the\nhost (CVE-2016-9932).\n\nx86 PV guests may be able to mask interrupts. A malicious guest kernel\nadministrator can cause a host hang or crash, resulting in a Denial of\nService (CVE-2016-10024).\n\nx86: Mishandling of SYSCALL singlestep during emulation. Guest userspace\nwhich can invoke the instruction emulator can use this flaw to escalate\nits privilege to that of the guest kernel (CVE-2016-10013).\n\nFor other fixes in this update, see the referenced changelogs.\n","status":"published","published":"2017-01-09T20:29:57Z","modified":"2026-04-16T06:26:07.137305065Z","updated_at":"2026-11-02T15:49:40.103088Z"},{"id":"SUSE-SU-2016:2093-1","title":"Security update for xen","description":"This update for xen to version 4.5.3 fixes the several issues.\n\nThese security issues were fixed:\n\n- CVE-2016-6258: Potential privilege escalation in PV guests (XSA-182) (bsc#988675).\n- CVE-2016-6259: Missing SMAP whitelisting in 32-bit exception / event delivery (XSA-183) (bsc#988676).\n- CVE-2016-5337: The megasas_ctrl_get_info function allowed local guest OS administrators to obtain sensitive host memory information via vectors related to reading device control information (bsc#983973).\n- CVE-2016-5338: The (1) esp_reg_read and (2) esp_reg_write functions allowed local guest OS administrators to cause a denial of service (QEMU process crash) or execute arbitrary code on the host via vectors related to the information transfer buffer (bsc#983984).\n- CVE-2016-5238: The get_cmd function in hw/scsi/esp.c might have allowed local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) via vectors related to reading from the information transfer buffer in non-DMA mode (bsc#982960).\n- CVE-2016-4453: The vmsvga_fifo_run function allowed local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via a VGA command (bsc#982225).\n- CVE-2016-4454: The vmsvga_fifo_read_raw function allowed local guest OS administrators to obtain sensitive host memory information or cause a denial of service (QEMU process crash) by changing FIFO registers and issuing a VGA command, which triggered an out-of-bounds read (bsc#982224).\n- CVE-2016-5126: Heap-based buffer overflow in the iscsi_aio_ioctl function allowed local guest OS users to cause a denial of service (QEMU process crash) or possibly execute arbitrary code via a crafted iSCSI asynchronous I/O ioctl call (bsc#982286).\n- CVE-2016-5105: Stack information leakage while reading configuration (bsc#982024).\n- CVE-2016-5106: Out-of-bounds write while setting controller properties (bsc#982025).\n- CVE-2016-5107: Out-of-bounds read in megasas_lookup_frame() function (bsc#982026).\n- CVE-2016-4963: The libxl device-handling allowed local guest OS users with access to the driver domain to cause a denial of service (management tool confusion) by manipulating information in the backend directories in xenstore (bsc#979670).\n- CVE-2016-4962: The libxl device-handling allowed local OS guest administrators to cause a denial of service (resource consumption or management facility confusion) or gain host OS privileges by manipulating information in guest controlled areas of xenstore (bsc#979620).\n- CVE-2016-4952: Out-of-bounds access issue in pvsci_ring_init_msg/data routines (bsc#981276).\n- CVE-2014-3672: The qemu implementation in libvirt Xen allowed local guest OS users to cause a denial of service (host disk consumption) by writing to stdout or stderr (bsc#981264).\n- CVE-2016-4441: The get_cmd function in the 53C9X Fast SCSI Controller (FSC) support did not properly check DMA length, which allowed local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) via unspecified vectors, involving an SCSI command (bsc#980724).\n- CVE-2016-4439: The esp_reg_write function in the 53C9X Fast SCSI Controller (FSC) support did not properly check command buffer length, which allowed local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) or potentially execute arbitrary code on the host via unspecified vectors (bsc#980716).\n- CVE-2016-3710: The VGA module improperly performed bounds checking on banked access to video memory, which allowed local guest OS administrators to execute arbitrary code on the host by changing access modes after setting the bank register, aka the 'Dark Portal' issue (bsc#978164).\n- CVE-2016-3960: Integer overflow in the x86 shadow pagetable code allowed local guest OS users to cause a denial of service (host crash) or possibly gain privileges by shadowing a superpage mapping (bsc#974038).\n- CVE-2016-3159: The fpu_fxrstor function in arch/x86/i387.c did not properly handle writes to the hardware FSW.ES bit when running on AMD64 processors, which allowed local guest OS users to obtain sensitive register content information from another guest by leveraging pending exception and mask bits (bsc#973188).\n- CVE-2016-3158: The xrstor function did not properly handle writes to the hardware FSW.ES bit when running on AMD64 processors, which allowed local guest OS users to obtain sensitive register content information from another guest by leveraging pending exception and mask bits (bsc#973188).\n- CVE-2016-4037: The ehci_advance_state function in hw/usb/hcd-ehci.c allowed local guest OS administrators to cause a denial of service (infinite loop and CPU consumption) via a circular split isochronous transfer descriptor (siTD) list (bsc#976111).\n- CVE-2016-4020: The patch_instruction function did not initialize the imm32 variable, which allowed local guest OS administrators to obtain sensitive information from host stack memory by accessing the Task Priority Register (TPR) (bsc#975907).\n- CVE-2016-4001: Buffer overflow in the stellaris_enet_receive function, when the Stellaris ethernet controller is configured to accept large packets, allowed remote attackers to cause a denial of service (QEMU crash) via a large packet (bsc#975130).\n- CVE-2016-4002: Buffer overflow in the mipsnet_receive function, when the guest NIC is configured to accept large packets, allowed remote attackers to cause a denial of service (memory corruption and QEMU crash) or possibly execute arbitrary code via a packet larger than 1514 bytes (bsc#975138).\n- bsc#978295: x86 software guest page walk PS bit handling flaw (XSA-176)\n- CVE-2016-5403: virtio: unbounded memory allocation on host via guest leading to DoS (XSA-184) (bsc#990923)\n- CVE-2016-6351: scsi: esp: OOB write access in esp_do_dma (bsc#990843)\n\nThese non-security issues were fixed:\n\n- bsc#986586: Out of memory (oom) during boot on 'modprobe xenblk' (non xen kernel)\n- bsc#900418: Dump cannot be performed on SLES12 XEN\n- bsc#953339: Implement SUSE specific unplug protocol for emulated PCI devices in PVonHVM guests to qemu-xen-upstream\n- bsc#953362: Implement SUSE specific unplug protocol for emulated PCI devices in PVonHVM guests to qemu-xen-upstream\n- bsc#953518: Implement SUSE specific unplug protocol for emulated PCI devices in PVonHVM guests to qemu-xen-upstream\n- bsc#984981: Implement SUSE specific unplug protocol for emulated PCI devices in PVonHVM guests to qemu-xen-upstream\n- bsc#954872: Script block-dmmd not working as expected - libxl: error: libxl_dm.c (Additional fixes)\n- bsc#982695: qemu fails to boot HVM guest from xvda\n- bsc#958848: HVM guest crash at /usr/src/packages/BUILD/xen-4.4.2-testing/obj/default/balloon/balloon.c:407\n- bsc#949889: Fail to install 32-bit paravirt VM under SLES12SP1Beta3 XEN\n- bsc#954872: Script block-dmmd not working as expected - libxl: error: libxl_dm.c (another modification)\n- bsc#961600: Poor performance when Xen HVM domU configured with max memory greater than current memory\n- bsc#963161: Windows VM getting stuck during load while a VF is assigned to it after upgrading to latest maintenance updates\n- bsc#976058: Xen error running simple HVM guest (Post Alpha 2 xen+qemu)\n- bsc#973631: AWS EC2 kdump issue\n- bsc#957986: Indirect descriptors are not compatible with Amazon block backend\n- bsc#964427: Discarding device blocks: failed - Input/output error\n- bsc#985503: Fixed vif-route \n- bsc#978413: PV guest upgrade from SLES11 SP4 to SLES 12 SP2 alpha3 failed \n","status":"published","published":"2016-08-17T12:22:27Z","modified":"2026-02-04T02:40:45.544605Z","updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"SUSE-SU-2016:2100-1","title":"Security update for xen","description":"This update for xen fixes the several issues.\n\nThese security issues were fixed:\n- CVE-2014-3672: The qemu implementation in libvirt Xen allowed local guest OS users to cause a denial of service (host disk consumption) by writing to stdout or stderr (bsc#981264).\n- CVE-2016-3158: The xrstor function did not properly handle writes to the hardware FSW.ES bit when running on AMD64 processors, which allowed local guest OS users to obtain sensitive register content information from another guest by leveraging pending exception and mask bits (bsc#973188).\n- CVE-2016-3159: The fpu_fxrstor function in arch/x86/i387.c did not properly handle writes to the hardware FSW.ES bit when running on AMD64 processors, which allowed local guest OS users to obtain sensitive register content information from another guest by leveraging pending exception and mask bits (bsc#973188).\n- CVE-2016-3710: The VGA module improperly performed bounds checking on banked access to video memory, which allowed local guest OS administrators to execute arbitrary code on the host by changing access modes after setting the bank register, aka the 'Dark Portal' issue (bsc#978164).\n- CVE-2016-3960: Integer overflow in the x86 shadow pagetable code allowed local guest OS users to cause a denial of service (host crash) or possibly gain privileges by shadowing a superpage mapping (bsc#974038).\n- CVE-2016-4001: Buffer overflow in the stellaris_enet_receive function, when the Stellaris ethernet controller is configured to accept large packets, allowed remote attackers to cause a denial of service (QEMU crash) via a large packet (bsc#975130).\n- CVE-2016-4002: Buffer overflow in the mipsnet_receive function, when the guest NIC is configured to accept large packets, allowed remote attackers to cause a denial of service (memory corruption and QEMU crash) or possibly execute arbitrary code via a packet larger than 1514 bytes (bsc#975138).\n- CVE-2016-4020: The patch_instruction function did not initialize the imm32 variable, which allowed local guest OS administrators to obtain sensitive information from host stack memory by accessing the Task Priority Register (TPR) (bsc#975907).\n- CVE-2016-4037: The ehci_advance_state function in hw/usb/hcd-ehci.c allowed local guest OS administrators to cause a denial of service (infinite loop and CPU consumption) via a circular split isochronous transfer descriptor (siTD) list (bsc#976111).\n- CVE-2016-4439: The esp_reg_write function in the 53C9X Fast SCSI Controller (FSC) support did not properly check command buffer length, which allowed local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) or potentially execute arbitrary code on the host via unspecified vectors (bsc#980716).\n- CVE-2016-4441: The get_cmd function in the 53C9X Fast SCSI Controller (FSC) support did not properly check DMA length, which allowed local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) via unspecified vectors, involving an SCSI command (bsc#980724).\n- CVE-2016-4453: The vmsvga_fifo_run function allowed local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via a VGA command (bsc#982225).\n- CVE-2016-4454: The vmsvga_fifo_read_raw function allowed local guest OS administrators to obtain sensitive host memory information or cause a denial of service (QEMU process crash) by changing FIFO registers and issuing a VGA command, which triggered an out-of-bounds read (bsc#982224).\n- CVE-2016-4952: Out-of-bounds access issue in pvsci_ring_init_msg/data routines (bsc#981276).\n- CVE-2016-4962: The libxl device-handling allowed local OS guest administrators to cause a denial of service (resource consumption or management facility confusion) or gain host OS privileges by manipulating information in guest controlled areas of xenstore (bsc#979620).\n- CVE-2016-4963: The libxl device-handling allowed local guest OS users with access to the driver domain to cause a denial of service (management tool confusion) by manipulating information in the backend directories in xenstore (bsc#979670).\n- CVE-2016-5105: Stack information leakage while reading configuration (bsc#982024).\n- CVE-2016-5106: Out-of-bounds write while setting controller properties (bsc#982025).\n- CVE-2016-5107: Out-of-bounds read in megasas_lookup_frame() function (bsc#982026).\n- CVE-2016-5126: Heap-based buffer overflow in the iscsi_aio_ioctl function allowed local guest OS users to cause a denial of service (QEMU process crash) or possibly execute arbitrary code via a crafted iSCSI asynchronous I/O ioctl call (bsc#982286).\n- CVE-2016-5238: The get_cmd function in hw/scsi/esp.c might have allowed local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) via vectors related to reading from the information transfer buffer in non-DMA mode (bsc#982960).\n- CVE-2016-5337: The megasas_ctrl_get_info function allowed local guest OS administrators to obtain sensitive host memory information via vectors related to reading device control information (bsc#983973).\n- CVE-2016-5338: The (1) esp_reg_read and (2) esp_reg_write functions allowed local guest OS administrators to cause a denial of service (QEMU process crash) or execute arbitrary code on the host via vectors related to the information transfer buffer (bsc#983984).\n- CVE-2016-6258: Potential privilege escalation in PV guests (XSA-182) (bsc#988675).\n- bsc#978295: x86 software guest page walk PS bit handling flaw (XSA-176)\n- CVE-2016-5403: virtio: unbounded memory allocation on host via guest leading to DoS (XSA-184) (bsc#990923)\n- CVE-2016-6351: scsi: esp: OOB write access in esp_do_dma (bsc#990843)\n\nThese non-security issues were fixed:\n- bsc#954872: Script block-dmmd not working as expected - libxl: error: libxl_dm.c\n- bsc#957986: Indirect descriptors are not compatible with Amazon block backend\n- bsc#958848: HVM guest crash at /usr/src/packages/BUILD/xen-4.4.2-testing/obj/default/balloon/balloon.c:407\n- bsc#961600: Poor performance when Xen HVM domU configured with max memory greater than current memory\n- bsc#963161: Windows VM getting stuck during load while a VF is assigned to it after upgrading to latest maintenance updates\n- bsc#964427: Discarding device blocks: failed - Input/output error\n- bsc#976058: Xen error running simple HVM guest (Post Alpha 2 xen+qemu)\n- bsc#982695: qemu fails to boot HVM guest from xvda\n- bsc#986586: Out of memory (oom) during boot on 'modprobe xenblk' (non xen kernel)\n- bsc#967630: Discrepancy in reported memory size with correction XSA-153 for xend. Additional memory adjustment made.\n- bsc#974912: Persistent performance drop after live-migration using xend tool stack\n- bsc#979035: Restore xm migrate fixes for bsc#955399/ bsc#955399\n- bsc#989235: xen dom0 xm create command only searched /etc/xen instead of /etc/xen/vm\n- Live Migration SLES 11 SP3 to SP4 on AMD: 'xc: error: Couldn't set extended vcpu0 info'\n- bsc#985503: Fixed vif-route\n- bsc#978413: PV guest upgrade from SLES11 SP4 to SLES 12 SP2 alpha3 failed\n","status":"published","published":"2016-08-18T12:48:09Z","modified":"2026-02-04T03:16:00.994297Z","updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"SUSE-SU-2016:2533-1","title":"Security update for xen","description":"This update for xen fixes several issues.\n\nThese security issues were fixed:\n- CVE-2014-3672: The qemu implementation in libvirt Xen allowed local guest OS users to cause a denial of service (host disk consumption) by writing to stdout or stderr (bsc#981264).\n- CVE-2016-3158: The xrstor function did not properly handle writes to the hardware FSW.ES bit when running on AMD64 processors, which allowed local guest OS users to obtain sensitive register content information from another guest by leveraging pending exception and mask bits (bsc#973188).\n- CVE-2016-3159: The fpu_fxrstor function in arch/x86/i387.c did not properly handle writes to the hardware FSW.ES bit when running on AMD64 processors, which allowed local guest OS users to obtain sensitive register content information from another guest by leveraging pending exception and mask bits (bsc#973188).\n- CVE-2016-3710: The VGA module improperly performed bounds checking on banked access to video memory, which allowed local guest OS administrators to execute arbitrary code on the host by changing access modes after setting the bank register, aka the 'Dark Portal' issue (bsc#978164)\n- CVE-2016-3960: Integer overflow in the x86 shadow pagetable code allowed local guest OS users to cause a denial of service (host crash) or possibly gain privileges by shadowing a superpage mapping (bsc#974038).\n- CVE-2016-4001: Buffer overflow in the stellaris_enet_receive function, when the Stellaris ethernet controller is configured to accept large packets, allowed remote attackers to cause a denial of service (QEMU crash) via a large packet (bsc#975130).\n- CVE-2016-4002: Buffer overflow in the mipsnet_receive function, when the guest NIC is configured to accept large packets, allowed remote attackers to cause a denial of service (memory corruption and QEMU crash) or possibly execute arbitrary code via a packet larger than 1514 bytes (bsc#975138).\n- CVE-2016-4020: The patch_instruction function did not initialize the imm32 variable, which allowed local guest OS administrators to obtain sensitive information from host stack memory by accessing the Task Priority Register (TPR) (bsc#975907)\n- CVE-2016-4037: The ehci_advance_state function in hw/usb/hcd-ehci.c allowed local guest OS administrators to cause a denial of service (infinite loop and CPU consumption) via a circular split isochronous transfer descriptor (siTD) list (bsc#976111)\n- CVE-2016-4439: The esp_reg_write function in the 53C9X Fast SCSI Controller (FSC) support did not properly check command buffer length, which allowed local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) or potentially execute arbitrary code on the host via unspecified vectors (bsc#980716)\n- CVE-2016-4441: The get_cmd function in the 53C9X Fast SCSI Controller (FSC) support did not properly check DMA length, which allowed local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) via unspecified vectors, involving an SCSI command (bsc#980724)\n- CVE-2016-4453: The vmsvga_fifo_run function allowed local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via a VGA command (bsc#982225)\n- CVE-2016-4454: The vmsvga_fifo_read_raw function allowed local guest OS administrators to obtain sensitive host memory information or cause a denial of service (QEMU process crash) by changing FIFO registers and issuing a VGA command, which triggered an out-of-bounds read (bsc#982224)\n- CVE-2016-4480: The guest_walk_tables function in arch/x86/mm/guest_walk.c in Xen did not properly handle the Page Size (PS) page table entry bit at the L4 and L3 page table levels, which might have allowed local guest OS users to gain privileges via a crafted mapping of memory (bsc#978295).\n- CVE-2016-4952: Out-of-bounds access issue in pvsci_ring_init_msg/data routines (bsc#981276)\n- CVE-2016-4962: The libxl device-handling allowed local OS guest administrators to cause a denial of service (resource consumption or management facility confusion) or gain host OS privileges by manipulating information in guest controlled areas of xenstore (bsc#979620)\n- CVE-2016-4963: The libxl device-handling allowed local guest OS users with access to the driver domain to cause a denial of service (management tool confusion) by manipulating information in the backend directories in xenstore (bsc#979670)\n- CVE-2016-5105: Stack information leakage while reading configuration (bsc#982024)\n- CVE-2016-5106: Out-of-bounds write while setting controller properties (bsc#982025)\n- CVE-2016-5107: Out-of-bounds read in megasas_lookup_frame() function (bsc#982026)\n- CVE-2016-5126: Heap-based buffer overflow in the iscsi_aio_ioctl function allowed local guest OS users to cause a denial of service (QEMU process crash) or possibly execute arbitrary code via a crafted iSCSI asynchronous I/O ioctl call (bsc#982286)\n- CVE-2016-5238: The get_cmd function in hw/scsi/esp.c might have allowed local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) via vectors related to reading from the information transfer buffer in non-DMA mode (bsc#982960)\n- CVE-2016-5337: The megasas_ctrl_get_info function allowed local guest OS administrators to obtain sensitive host memory information via vectors related to reading device control information (bsc#983973)\n- CVE-2016-5338: The (1) esp_reg_read and (2) esp_reg_write functions allowed local guest OS administrators to cause a denial of service (QEMU process crash) or execute arbitrary code on the host via vectors related to the information transfer buffer (bsc#983984)\n- CVE-2016-5403: virtio: unbounded memory allocation on host via guest leading to DoS (XSA-184) (bsc#990923)\n- CVE-2016-6258: The PV pagetable code in arch/x86/mm.c in Xen allowed local 32-bit PV guest OS administrators to gain host OS privileges by leveraging fast-paths for updating pagetable entries (bsc#988675)\n- CVE-2016-6351: The esp_do_dma function in hw/scsi/esp.c, when built with ESP/NCR53C9x controller emulation support, allowed local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) or execute arbitrary code on the host via vectors involving DMA read into ESP command buffer (bsc#990843).\n- CVE-2016-6833: A use-after-free issue in the VMWARE VMXNET3 NIC device support allowed privileged user inside guest to crash the Qemu instance resulting in DoS (bsc#994775).\n- CVE-2016-6834: A infinite loop during packet fragmentation in the VMWARE VMXNET3 NIC device support allowed privileged user inside guest to crash the Qemu instance resulting in DoS (bsc#994421).\n- CVE-2016-6835: Buffer overflow in the VMWARE VMXNET3 NIC device support, causing an OOB read access (bsc#994625).\n- CVE-2016-6836: VMWARE VMXNET3 NIC device allowed privileged user inside the guest to leak information. It occured while processing transmit(tx) queue, when it reaches the end of packet (bsc#994761).\n- CVE-2016-6888: A integer overflow int the VMWARE VMXNET3 NIC device support, during the initialisation of new packets in the device, could have allowed a privileged user inside guest to crash the Qemu instance resulting in DoS (bsc#994772).\n- CVE-2016-7092: The get_page_from_l3e function in arch/x86/mm.c in Xen allowed local 32-bit PV guest OS administrators to gain host OS privileges via vectors related to L3 recursive pagetables (bsc#995785)\n- CVE-2016-7093: Xen allowed local HVM guest OS administrators to overwrite hypervisor memory and consequently gain host OS privileges by leveraging mishandling of instruction pointer truncation during emulation (bsc#995789)\n- CVE-2016-7094: Buffer overflow in Xen allowed local x86 HVM guest OS administrators on guests running with shadow paging to cause a denial of service via a pagetable update (bsc#995792)\n- CVE-2016-7154: Use-after-free vulnerability in the FIFO event channel code in Xen allowed local guest OS administrators to cause a denial of service (host crash) and possibly execute arbitrary code or obtain sensitive information via an invalid guest frame number (bsc#997731).\n\nThese non-security issues were fixed:\n- bsc#991934: Hypervisor crash in csched_acct\n- bsc#992224: During boot of Xen Hypervisor, failed to get contiguous memory for DMA\n- bsc#970135: New virtualization project clock test randomly fails on Xen \n- bsc#971949: xl: Support (by ignoring) xl migrate --live. xl migrations are always live\n- bsc#990970: Add PMU support for Intel E7-8867 v4 (fam=6, model=79)\n- bsc#985503: vif-route broken\n- bsc#978413: PV guest upgrade from sles11sp4 to sles12sp2 alpha3 failed on sles11sp4 xen host.\n- bsc#986586: Out of memory (oom) during boot on 'modprobe xenblk' (non xen kernel)\n- bsc#953339, bsc#953362, bsc#953518, bsc#984981: Implement SUSE specific unplug protocol for emulated PCI devices in PVonHVM guests to qemu-xen-upstream\n- bsc#958848: HVM guest crash at /usr/src/packages/BUILD/ xen-4.4.2-testing/obj/default/balloon/balloon.c:407\n- bsc#982695: xen-4.5.2 qemu fails to boot HVM guest from xvda \n- bsc#954872: script block-dmmd not working as expected\n- bsc#961600: : poor performance when Xen HVM domU configured with max memory \u003e current memory\n- bsc#979035: Restore xm migrate fixes for bsc#955399/ bsc#955399\n- bsc#963161: Windows VM getting stuck during load while a VF is assigned to it\n- bsc#976058: Xen error running simple HVM guest (Post Alpha 2 xen+qemu)\n- bsc#957986: Indirect descriptors are not compatible with Amazon block backend\n- bsc#973631: AWS EC2 kdump issue\n- bsc#964427: Discarding device blocks failed with input/output error\n","status":"published","published":"2016-10-13T15:12:40Z","modified":"2026-02-04T03:26:55.353348Z","updated_at":"2026-11-02T15:53:43.438985Z"}]}}