Description
The paging_invlpg function in include/asm-x86/paging.h in Xen 3.3.x through 4.6.x, when using shadow mode paging or nested virtualization is enabled, allows local HVM guest users to cause a denial of service (host crash) via a non-canonical guest address in an INVVPID instruction, which triggers a hypervisor bug check.
References (4)
Core 4
Core References
Third Party Advisory vdb-entry
x_refsource_sectrack
http://www.securitytracker.com/id/1034745
Third Party Advisory x_refsource_confirm
http://support.citrix.com/article/CTX205496
Vendor Advisory x_refsource_confirm
http://xenbits.xen.org/xsa/advisory-168.html
Third Party Advisory vendor-advisory
x_refsource_debian
http://www.debian.org/security/2016/dsa-3519
Scores
CVSS v3
6.3
EPSS
0.0030
EPSS Percentile
53.1%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H
Details
CWE
CWE-17
Status
published
Products (36)
citrix/xenserver
< 6.5
xen/xen
3.3.0
xen/xen
3.3.1
xen/xen
3.3.2
xen/xen
3.4.0
xen/xen
3.4.1
xen/xen
3.4.2
xen/xen
3.4.3
xen/xen
3.4.4
xen/xen
4.1.0
... and 26 more
Published
Jan 22, 2016
Tracked Since
Feb 18, 2026