CVE-2016-3960
HighSummary
Integer overflow in the x86 shadow pagetable code in Xen allows local guest OS users to cause a denial of service (host crash) or possibly gain privileges by shadowing a superpage mapping.
Risk Assessment
This vulnerability can lead to system crashes, affecting service availability and potentially allowing unauthorized access to system resources.
Recommendation
It is recommended to update to the latest version of Xen that includes fixes for this overflow and to monitor the system for unauthorized activities.
Other vulnerabilities in Xen hypervisor
See all- CVE-2026-23558High
CVE-2026-23558 describes a race condition that occurs during the grant table version change from v2 to v1 in HVM or PVH guests. This issue may lead to some status pages being freed while their mappings are still being inserted into the guest's page tables.
- CVE-2017-15595High
An issue was discovered in Xen through 4.9.x allowing x86 PV guest OS users to cause a denial of service (unbounded recursion, stack consumption, and hypervisor crash) or possibly gain privileges via crafted page-table stacking.
- CVE-2017-15594High
An issue was discovered in Xen through 4.9.x allowing x86 SVM PV guest OS users to cause a denial of service (hypervisor crash) or gain privileges because IDT settings are mishandled during CPU hotplugging.
- CVE-2017-15592High
An issue was discovered in Xen through 4.9.x allowing x86 HVM guest OS users to cause a denial of service (hypervisor crash) or possibly gain privileges because self-linear shadow mappings are mishandled for translated guests.
- CVE-2017-15590High
An issue was discovered in Xen through 4.9.x allowing x86 guest OS users to cause a denial of service (hypervisor crash) or possibly gain privileges because MSI mapping was mishandled.
- CVE-2017-15588High
An issue was discovered in Xen through 4.9.x allowing x86 PV guest OS users to execute arbitrary code on the host OS because of a race condition that can cause a stale TLB entry.
- CVE-2017-14319High
A grant unmapping issue was discovered in Xen through 4.9.x. When removing or replacing a grant mapping, the x86 PV specific path needs to ensure page table entries remain in sync with other accounting done.
- CVE-2017-12137High
In the x86 architecture of Xen, a vulnerability allows local PV guest OS users to gain host privileges via vectors related to map_grant_ref.
- CVE-2017-10916High
The vCPU context-switch implementation in Xen through 4.8.x improperly interacts with the Memory Protection Extensions (MPX) and Protection Key (PKU) features, making it easier for guest OS users to defeat ASLR and other protection mechanisms.
- CVE-2017-8904High
Xen through 4.8.x mishandles the 'contains segment descriptors' property during GNTTABOP_transfer operations, which might allow PV guest OS users to execute arbitrary code on the host OS.
Original NVD description (English source)
Integer overflow in the x86 shadow pagetable code in Xen allows local guest OS users to cause a denial of service (host crash) or possibly gain privileges by shadowing a superpage mapping.