Use-after-free vulnerability in the xc_cpupool_getinfo function in Xen 4.1.x through 4.3.x, when using a multithreaded toolstack, does not properly handle a failure by the xc_cpumap_alloc function, which allows local users with access to management functions to cause a denial of service (heap corruption) and possibly gain privileges via unspecified vectors.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Xen | Xen | 4.1.1 (including) | 4.1.1 (including) |
| Xen | Xen | 4.1.2 (including) | 4.1.2 (including) |
| Xen | Xen | 4.1.3 (including) | 4.1.3 (including) |
| Xen | Xen | 4.1.4 (including) | 4.1.4 (including) |
| Xen | Xen | 4.1.5 (including) | 4.1.5 (including) |
| Xen | Xen | 4.1.6.1 (including) | 4.1.6.1 (including) |
| Xen | Xen | 4.2.0 (including) | 4.2.0 (including) |
| Xen | Xen | 4.2.1 (including) | 4.2.1 (including) |
| Xen | Xen | 4.2.2 (including) | 4.2.2 (including) |
| Xen | Xen | 4.2.3 (including) | 4.2.3 (including) |
| Xen | Xen | 4.3.0 (including) | 4.3.0 (including) |
| Xen | Xen | 4.3.1 (including) | 4.3.1 (including) |
| Xen | Ubuntu | devel | * |
| Xen | Ubuntu | precise | * |
| Xen | Ubuntu | quantal | * |
| Xen | Ubuntu | saucy | * |
| Xen-3.3 | Ubuntu | upstream | * |