FKIE_CVE-2013-1964

Vulnerability from fkie_nvd - Published: 2013-05-21 18:55 - Updated: 2025-04-11 00:51
Severity ?
Summary
Xen 4.0.x and 4.1.x incorrectly releases a grant reference when releasing a non-v1, non-transitive grant, which allows local guest administrators to cause a denial of service (host crash), obtain sensitive information, or possibly have other impacts via unspecified vectors.
References
secalert@redhat.comhttp://lists.fedoraproject.org/pipermail/package-announce/2013-May/104537.html
secalert@redhat.comhttp://lists.opensuse.org/opensuse-security-announce/2014-03/msg00021.html
secalert@redhat.comhttp://secunia.com/advisories/55082
secalert@redhat.comhttp://security.gentoo.org/glsa/glsa-201309-24.xml
secalert@redhat.comhttp://www.debian.org/security/2013/dsa-2666
secalert@redhat.comhttp://www.openwall.com/lists/oss-security/2013/04/18/9
secalert@redhat.comhttp://www.securityfocus.com/bid/59293
secalert@redhat.comhttp://www.securitytracker.com/id/1028459
af854a3a-2127-422b-91ae-364da2661108http://lists.fedoraproject.org/pipermail/package-announce/2013-May/104537.html
af854a3a-2127-422b-91ae-364da2661108http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00021.html
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/55082
af854a3a-2127-422b-91ae-364da2661108http://security.gentoo.org/glsa/glsa-201309-24.xml
af854a3a-2127-422b-91ae-364da2661108http://www.debian.org/security/2013/dsa-2666
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2013/04/18/9
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/59293
af854a3a-2127-422b-91ae-364da2661108http://www.securitytracker.com/id/1028459
Impacted products
Vendor Product Version
xen xen 4.0.0
xen xen 4.0.1
xen xen 4.0.2
xen xen 4.0.3
xen xen 4.0.4
xen xen 4.1.0
xen xen 4.1.1
xen xen 4.1.2
xen xen 4.1.3
xen xen 4.1.4
xen xen 4.1.5
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:xen:xen:4.0.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "550223A9-B9F1-440A-8C25-9F0F76AF7301",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:xen:xen:4.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "FC734D58-96E5-4DD2-8781-F8E0ADB96462",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:xen:xen:4.0.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "62CEC1BF-1922-410D-BCBA-C58199F574C7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:xen:xen:4.0.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "923F2C2B-4A65-4823-B511-D0FEB7C7FAB2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:xen:xen:4.0.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "C1A24DED-B2EC-4D9C-9FA4-DD37EF3E3BFC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:xen:xen:4.1.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "0D532B60-C8DD-4A2F-9D05-E574D23EB754",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:xen:xen:4.1.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "5D83CA8B-8E49-45FA-8FAB-C15052474542",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:xen:xen:4.1.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "27537DF5-7E0F-463F-BA87-46E329EE07AC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:xen:xen:4.1.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "3EA4F978-9145-4FE6-B4F9-15207E52C40A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:xen:xen:4.1.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "22A995FD-9B7F-4DF0-BECF-4B086E470F1E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:xen:xen:4.1.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "219597E2-E2D7-4647-8A7C-688B96300158",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Xen 4.0.x and 4.1.x incorrectly releases a grant reference when releasing a non-v1, non-transitive grant, which allows local guest administrators to cause a denial of service (host crash), obtain sensitive information, or possibly have other impacts via unspecified vectors."
    },
    {
      "lang": "es",
      "value": "Xen versiones 4.0.x y 4.1.x, libera incorrectamente una referencia de concesi\u00f3n al liberar una concesi\u00f3n sin-v1, sin transmitir, que permite a los administradores invitados locales causar una denegaci\u00f3n de servicio (bloqueo del host), obtener informaci\u00f3n, o posiblemente tener otros impactos por medio de vectores no especificados."
    }
  ],
  "id": "CVE-2013-1964",
  "lastModified": "2025-04-11T00:51:21.963",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "LOCAL",
          "authentication": "NONE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 6.9,
          "confidentialityImpact": "COMPLETE",
          "integrityImpact": "COMPLETE",
          "vectorString": "AV:L/AC:M/Au:N/C:C/I:C/A:C",
          "version": "2.0"
        },
        "exploitabilityScore": 3.4,
        "impactScore": 10.0,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2013-05-21T18:55:01.907",
  "references": [
    {
      "source": "secalert@redhat.com",
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-May/104537.html"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00021.html"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://secunia.com/advisories/55082"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://security.gentoo.org/glsa/glsa-201309-24.xml"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.debian.org/security/2013/dsa-2666"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.openwall.com/lists/oss-security/2013/04/18/9"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.securityfocus.com/bid/59293"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.securitytracker.com/id/1028459"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-May/104537.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00021.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/55082"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://security.gentoo.org/glsa/glsa-201309-24.xml"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.debian.org/security/2013/dsa-2666"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.openwall.com/lists/oss-security/2013/04/18/9"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/59293"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securitytracker.com/id/1028459"
    }
  ],
  "sourceIdentifier": "secalert@redhat.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-264"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.