VulnerabilityModified
CVE-2013-4554
Xen 3.0.3 through 4.1.x (possibly 4.1.6.1), 4.2.x (possibly 4.2.3), and 4.3.x (possibly 4.3.1) does not properly prevent access to hypercalls, which allows local guest users to gain privileges via a crafted application running in ring 1 or 2.
MEDIUM 5.2EPSS 0.61%
Does this matter?
Lower severity and a low EPSS score (0.61%). Track it; it rarely justifies an emergency change on its own.
Description
Xen 3.0.3 through 4.1.x (possibly 4.1.6.1), 4.2.x (possibly 4.2.3), and 4.3.x (possibly 4.3.1) does not properly prevent access to hypercalls, which allows local guest users to gain privileges via a crafted application running in ring 1 or 2.
- CVSS 2.0
- 5.2 MEDIUMAV:A/AC:L/Au:S/C:P/I:P/A:P
- EPSS
- 0.61% probability · 47th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-264
- Affected
- xen/xen
- Source
- secalert@redhat.com
References
- http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00010.html
- http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00015.html
- http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00021.html
- http://lists.opensuse.org/opensuse-security-announce/2014-04/msg00000.html
- http://lists.opensuse.org/opensuse-updates/2013-12/msg00059.html
- http://rhn.redhat.com/errata/RHSA-2014-0285.html
- http://security.gentoo.org/glsa/glsa-201407-03.xml
- http://www.openwall.com/lists/oss-security/2013/11/26/9
- http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00010.html
- http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00015.html
- http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00021.html
- http://lists.opensuse.org/opensuse-security-announce/2014-04/msg00000.html
- http://lists.opensuse.org/opensuse-updates/2013-12/msg00059.html
- http://rhn.redhat.com/errata/RHSA-2014-0285.html
- http://security.gentoo.org/glsa/glsa-201407-03.xml
- http://www.openwall.com/lists/oss-security/2013/11/26/9
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.