The compat_iret function in Xen 3.1 through 4.5 iterates the wrong way through a loop, which allows local 32-bit PV guest administrators to cause a denial of service (large loop and system hang) via a hypercall_iret call with EFLAGS.VM set.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Xen | Xen | 3.1.3 (including) | 3.1.3 (including) |
| Xen | Xen | 3.1.4 (including) | 3.1.4 (including) |
| Xen | Xen | 3.2.0 (including) | 3.2.0 (including) |
| Xen | Xen | 3.2.1 (including) | 3.2.1 (including) |
| Xen | Xen | 3.2.2 (including) | 3.2.2 (including) |
| Xen | Xen | 3.2.3 (including) | 3.2.3 (including) |
| Xen | Xen | 3.3.0 (including) | 3.3.0 (including) |
| Xen | Xen | 3.3.1 (including) | 3.3.1 (including) |
| Xen | Xen | 3.3.2 (including) | 3.3.2 (including) |
| Xen | Xen | 3.4.0 (including) | 3.4.0 (including) |
| Xen | Xen | 3.4.1 (including) | 3.4.1 (including) |
| Xen | Xen | 3.4.2 (including) | 3.4.2 (including) |
| Xen | Xen | 3.4.3 (including) | 3.4.3 (including) |
| Xen | Xen | 3.4.4 (including) | 3.4.4 (including) |
| Xen | Xen | 4.0.0 (including) | 4.0.0 (including) |
| Xen | Xen | 4.0.1 (including) | 4.0.1 (including) |
| Xen | Xen | 4.0.2 (including) | 4.0.2 (including) |
| Xen | Xen | 4.0.3 (including) | 4.0.3 (including) |
| Xen | Xen | 4.0.4 (including) | 4.0.4 (including) |
| Xen | Xen | 4.1.0 (including) | 4.1.0 (including) |
| Xen | Xen | 4.1.1 (including) | 4.1.1 (including) |
| Xen | Xen | 4.1.2 (including) | 4.1.2 (including) |
| Xen | Xen | 4.1.3 (including) | 4.1.3 (including) |
| Xen | Xen | 4.1.4 (including) | 4.1.4 (including) |
| Xen | Xen | 4.1.5 (including) | 4.1.5 (including) |
| Xen | Xen | 4.1.6.1 (including) | 4.1.6.1 (including) |
| Xen | Xen | 4.2.0 (including) | 4.2.0 (including) |
| Xen | Xen | 4.2.1 (including) | 4.2.1 (including) |
| Xen | Xen | 4.2.2 (including) | 4.2.2 (including) |
| Xen | Xen | 4.2.3 (including) | 4.2.3 (including) |
| Xen | Xen | 4.3.0 (including) | 4.3.0 (including) |
| Xen | Xen | 4.3.1 (including) | 4.3.1 (including) |
| Xen | Xen | 4.3.4 (including) | 4.3.4 (including) |
| Xen | Xen | 4.4.0 (including) | 4.4.0 (including) |
| Xen | Xen | 4.4.0-rc1 (including) | 4.4.0-rc1 (including) |
| Xen | Xen | 4.4.1 (including) | 4.4.1 (including) |
| Xen | Xen | 4.5.0 (including) | 4.5.0 (including) |
| Xen | Ubuntu | precise | * |
| Xen | Ubuntu | trusty | * |
| Xen | Ubuntu | utopic | * |
| Xen | Ubuntu | vivid | * |