vulnwire
4.6med

CVE-2007-6416

The copy_to_user function in the PAL emulation functionality for Xen 3.1.2 and earlier, when running on ia64 systems, allows HVM guest user…

Published 18 y ago · modified 4 mo ago · JSON

CVSS
4.6
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
0.4%
percentile 38%
Public exploits
0
none known

The copy_to_user function in the PAL emulation functionality for Xen 3.1.2 and earlier, when running on ia64 systems, allows HVM guest users to access arbitrary physical memory by triggering certain mapping operations.

Exploit prediction (EPSS)

0.44% probability of exploitation in the next 30 days, higher than 38% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD2.04.6AV:L/AC:L/Au:N/C:P/I:P/A:P

Classification

Weakness
  • CWE-264 Permissions, Privileges, and Access Controls

References

  • secunia.com /advisories/28643 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • oval.cisecurity.org /repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9840 · vdb-entry, signature, x_refsource_OVAL, x_transferred
  • xenbits.xensource.com /ext/ia64/xen-unstable.hg?rev/e6069a715fd7 · x_refsource_CONFIRM, x_transferred
  • securityfocus.com /bid/26954 · vdb-entry, x_refsource_BID, x_transferred
  • secunia.com /advisories/28146 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • osvdb.org /41344 · vdb-entry, x_refsource_OSVDB, x_transferred
  • redhat.com /support/errata/RHSA-2008-0089.html · vendor-advisory, x_refsource_REDHAT, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.