Xen, possibly before 4.0.2, allows local 64-bit PV guests to cause a denial of service (host crash) by specifying user mode execution witho…

published 2014-01-07 12 y ago modified 2026-06-16 4 mo ago also EUVD-2011-1176

cvss: 5.5; version 2.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 0.7%; EPSS 0.7% chance of exploitation in 30 days, percentile 52%
public exploits: 0; none known

Xen, possibly before 4.0.2, allows local 64-bit PV guests to cause a denial of service (host crash) by specifying user mode execution without user-mode pagetables.

Patch / fix

distros 2 links 1

debian red hat

xen Debian 14, Debian 13, Debian 12 4.1.0-1

debian advisories DEBIAN-CVE-2011-1166

kernel RHEL 5 2.6.18-238.12.1.el5
kernel-PAE RHEL 5 2.6.18-238.12.1.el5
kernel-xen RHEL 5 2.6.18-238.12.1.el5
kernel-kdump RHEL 5 2.6.18-238.12.1.el5
kernel-debuginfo-common RHEL 5 2.6.18-238.12.1.el5

red hat advisories RHSA-2011:0833

wiki.xen.org/wiki/Security_Announcements#XSA-1_Host_crash_due_to_failur… advisory

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2011-1166 updated 2025-11-21 cvss 5.5

kernel: xen: x86_64: fix error checking in arch_set_info_guest()

Red Hat Enterprise Linux (v. 5.6.z server) kernel 2.6.18-238.12.1.el5, kernel-PAE 2.6.18-238.12.1.el5, kernel-xen 2.6.18-238.12.1.el5, kernel-kdump 2.6.18-238.12.1.el5, kernel-debuginfo-common 2.6.18-238.12.1.el5
fixed: vendor fix RHSA-2011:0833

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.67% chance of exploitation in the next 30 days, higher than 52% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by	version	score	vector
NVD	2.0	5.5	AV:A/AC:L/Au:S/C:N/I:N/A:C

Classification

Weakness

CWE-20 Improper Input Validation

References

wiki.xen.org /wiki/Security_Announcements#XSA-1_Host_crash_due_to_failure_to_correctly_validate_PV_kernel_execution_state.
patch, vendor-advisory
rhn.redhat.com /errata/RHSA-2011-0833.html
vendor-advisory
downloads.avaya.com /css/P8/documents/100145416

Sources

CVE List CVE-2011-1166
NVD CVE-2011-1166

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary