CVE-2008-4405: citrix xen

EPSS trend

Probability

1.04%

Chance of exploitation in the next 30 days

Percentile

63%

Versus all other CVEs

30-day change

0.00 pp

From 1.04% on 19-09-2026

19-09-202619-10-2026

EPSS score

1.04%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

2 found

referenceUnverified
Exploit Reference (xenbits.xensource.com)
Maturity: unknown
exploit-databaselocallinuxVerified
Xen 3.3 - XenStore Domain Configuration Data Unsafe Storage
Maturity: weaponized

References

15 links

www.vupen.com/english/advisories/2008/2709VDB EntryX Refsource VUPEN
bugzilla.redhat.com/show_bug.cgi?id=464817X Refsource CONFIRM
www.mandriva.com/security/advisories?name=MDVSA-2009:016Vendor AdvisoryX Refsource MANDRIVA
secunia.com/advisories/32064Third Party AdvisoryX Refsource SECUNIA
lists.xensource.com/archives/html/xen-devel/2008-09/msg00992.htmlMailing ListX Refsource MLIST
lists.opensuse.org/opensuse-security-announce/2009-09/msg00001.htmlVendor AdvisoryX Refsource SUSE
openwall.com/lists/oss-security/2008/09/30/6Mailing ListX Refsource MLIST
www.redhat.com/support/errata/RHSA-2009-0003.htmlVendor AdvisoryX Refsource REDHAT
xenbits.xensource.com/staging/xen-3.3-testing.hg?rev/e0e17216ba70X Refsource CONFIRMExploit
lists.xensource.com/archives/html/xen-devel/2008-09/msg00994.htmlMailing ListX Refsource MLIST

Show all 15 references

www.securityfocus.com/bid/31499VDB EntryX Refsource BID
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10627VDB EntrySignatureX Refsource OVAL
www.securitytracker.com/id?1020955VDB EntryX Refsource SECTRACK
www.openwall.com/lists/oss-security/2008/10/04/3Mailing ListX Refsource MLIST
bugzilla.redhat.com/show_bug.cgi?id=464818X Refsource CONFIRM

Related vulnerabilities

CVE-2008-5716citrixxen0.36%17y ago24-12-2008 17:00xend in Xen 3.3.0 does not properly restrict a guest VM's write access within the /local/domain xenstore directory tree, which allows guest OS users to cause a denial of service and possibly have unspecified other impact by writing to (1) console/tty, (2) console/limit, or (3) image/device-model-pid. NOTE: this issue exists because of erroneous set_permissions calls in the fix for CVE-2008-4405.CVE-2011-1898citrixxen+10.85%15y ago12-08-2011 18:00Xen 4.1 before 4.1.1 and 4.0 before 4.0.2, when using PCI passthrough on Intel VT-d chipsets that do not have interrupt remapping, allows guest OS users to gain host OS privileges by "using DMA to generate MSI interrupts by writing to the interrupt injection registers."CVE-2011-1583citrixxen+10.70%15y ago12-08-2011 18:00Multiple integer overflows in tools/libxc/xc_dom_bzimageloader.c in Xen 3.2, 3.3, 4.0, and 4.1 allow local users to cause a denial of service and possibly execute arbitrary code via a crafted paravirtualised guest kernel image that triggers (1) a buffer overflow during a decompression loop or (2) an out-of-bounds read in the loader involving unspecified length fields.CVE-2011-3262citrixxen+10.33%15y ago19-08-2011 20:00tools/libxc/xc_dom_bzimageloader.c in Xen 3.2, 3.3, 4.0, and 4.1 allows local users to cause a denial of service (management software infinite loop and management domain resource consumption) via unspecified vectors related to "Lack of error checking in the decompression loop."CVE-2010-4247citrixxen0.73%15y ago11-01-2011 01:00The do_block_io_op function in (1) drivers/xen/blkback/blkback.c and (2) drivers/xen/blktap/blktap.c in Xen before 3.4.0 for the Linux kernel 2.6.18, and possibly other versions, allows guest OS users to cause a denial of service (infinite loop and CPU consumption) via a large production request index to the blkback or blktap back-end drivers. NOTE: some of these details are obtained from third party information.CVE-2010-4255citrixxen+10.77%15y ago25-01-2011 00:00The fixup_page_fault function in arch/x86/traps.c in Xen 4.0.1 and earlier on 64-bit platforms, when paravirtualization is enabled, does not verify that kernel mode is used to call the handle_gdt_ldt_mapping_fault function, which allows guest OS users to cause a denial of service (host OS BUG_ON) via a crafted memory access.

All vulnerabilities inxen

CVE-2008-4405: citrix xen

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References