CVE-2013-4370

Xen 4.2.x and 4.3.x - Use-After-Free in OCaml xc_vcpu_getaffinity Binding

Title source: llm
STIX 2.1

Description

The ocaml binding for the xc_vcpu_getaffinity function in Xen 4.2.x and 4.3.x frees certain memory that may still be intended for use, which allows local users to cause a denial of service (heap corruption and crash) and possibly execute arbitrary code via unspecified vectors that trigger a (1) use-after-free or (2) double free.

References (3)

Core 3
Core References
Third Party Advisory vendor-advisory x_refsource_gentoo
http://security.gentoo.org/glsa/glsa-201407-03.xml
Mailing List mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2013/10/10/13

Scores

EPSS 0.0009
EPSS Percentile 24.6%

Details

CWE
CWE-119
Status published
Products (5)
xen/xen 4.2.0
xen/xen 4.2.1
xen/xen 4.2.2
xen/xen 4.2.3
xen/xen 4.3.0
Published Oct 17, 2013
Tracked Since Feb 18, 2026