CVE-2013-4553

Xen 3.4.x-4.3.x - Denial of Service via XEN_DOMCTL_getmemlist Hypercall Deadlock

Title source: llm
STIX 2.1

Description

The XEN_DOMCTL_getmemlist hypercall in Xen 3.4.x through 4.3.x (possibly 4.3.1) does not always obtain the page_alloc_lock and mm_rwlock in the same order, which allows local guest administrators to cause a denial of service (host deadlock).

References (6)

Core 6
Core References
Mailing List mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2013/11/26/8
Third Party Advisory vendor-advisory x_refsource_gentoo
http://security.gentoo.org/glsa/glsa-201407-03.xml
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2014/dsa-3006
Mailing List vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-updates/2013-12/msg00059.html

Scores

EPSS 0.0033
EPSS Percentile 55.9%

Details

CWE
CWE-119
Status published
Products (23)
xen/xen 3.4.0
xen/xen 3.4.1
xen/xen 3.4.2
xen/xen 3.4.3
xen/xen 3.4.4
xen/xen 4.0.0
xen/xen 4.0.1
xen/xen 4.0.2
xen/xen 4.0.3
xen/xen 4.0.4
... and 13 more
Published Dec 24, 2013
Tracked Since Feb 18, 2026