NVD

Id
38054  
Name
CVE-2013-1920  
Description
Xen 4.2.x, 4.1.x, and earlier, when the hypervisor is running "under memory pressure" and the Xen Security Module (XSM) is enabled, uses the wrong ordering of operations when extending the per-domain event channel tracking table, which causes a use-after-free and allows local guest kernels to inject arbitrary events and gain privileges via unspecified vectors.  
Reject
 
CVSS Version
2  
CVSS Score
4.4  
Severity
Medium  
CVSS Base Score
4.4  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
3.4  
CVSS Vector
(AV:L/AC:M/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-18  
Published
2013-04-12  
Modified Date
2014-04-19  
Seq
2013-1920  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
194450 38054 CVE-2013-1920 SUSE-SU-2014:0411  View
194451 38054 CVE-2013-1920 SUSE-SU-2014:0446  View
194452 38054 CVE-2013-1920 SUSE-SU-2014:0470  View
194453 38054 CVE-2013-1920 openSUSE-SU-2013:0912  View
194454 38054 CVE-2013-1920 [Xen-announce] 20130404 Xen Security Advisory 47 (CVE-2013-1920) - Potential use of freed memory in event channel operations  View
194455 38054 CVE-2013-1920 GLSA-201309-24  View
194456 38054 CVE-2013-1920 [oss-security] 20130404 Xen Security Advisory 47 (CVE-2013-1920) - Potential use of freed memory in event channel operations  View
194457 38054 CVE-2013-1920 58880  View
194458 38054 CVE-2013-1920 1028388  View
194459 38054 CVE-2013-1920 xen-cve20131920-code-exec(83226)  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
20655 JVNDB-2013-002230 Xen における任意のイベントを挿入される脆弱性 Xen は、ハイパーバイザがメモリ不足の状況で実行され、かつ Xen Security Module (XSM) が有効な場合、ドメインごとのイベントチャネルトラッキングテーブルを拡張する際に誤った操作手順を用いるため、解放済みメモリの使用 (Use-after-free) を引き起こし、任意のイベントを挿入される、および権限を取得される脆弱性が存在します。 CVE-2013-1920 61862 CVE-2013-1920 38054 4.4 http://jvndb.jvn.jp/ja/contents/2013/JVNDB-2013-002230.html 2013-04-04 2013-11-08 View