CVE-2013-6400

Severity: medium (CVSS 6.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2013-12-13 · updated 2026-06-17
Weakness: CWE-264

Description

Xen 4.2.x and 4.3.x, when using Intel VT-d and a PCI device has been assigned, does not clear the flag that suppresses IOMMU TLB flushes when unspecified errors occur, which causes the TLB entries to not be flushed and allows local guest administrators to cause a denial of service (host crash) or gain privileges via unspecified vectors.

Affected products

xen: 4.2.0, 4.2.1, 4.2.2, 4.2.3, 4.3.0, 4.3.1

References

http://lists.fedoraproject.org/pipermail/package-announce/2013-December/125081.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-December/125111.html
http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00011.html
http://lists.xen.org/archives/html/xen-announce/2013-12/msg00002.html
http://secunia.com/advisories/55932
http://security.gentoo.org/glsa/glsa-201407-03.xml
http://www.openwall.com/lists/oss-security/2013/12/10/7
http://www.securitytracker.com/id/1029468
http://lists.fedoraproject.org/pipermail/package-announce/2013-December/125081.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-December/125111.html
http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00011.html
http://lists.xen.org/archives/html/xen-announce/2013-12/msg00002.html

Get alerted when CVE-2013-6400 or the next vulnerability affects your stack