Disrepancy in number of exploitable bugs in Xen

[starius]

https://www.qubes-os.org/doc/vm-sudo/ says "so far there have been only one (!) publicly disclosed exploitable bug in the Xen hypervisor from a VM, found in 2008", but this seems to be outdated.

http://www.securityweek.com/xen-hypervisor-vulnerability-exposed-virtualized-servers tells about vulnerability CVE-2014-7188 forced the cloud to reboot many machines.

https://xenbits.xen.org/xsa/ lists hundreds of CVEs.

[jpouellet]

Not all Xen bugs affect Qubes, but yes, I believe that statement is no longer correct. XSA-182 / QSB #24 come to mind most recently.

[jpouellet]

Not all Xen bugs affect Qubes, but yes, I believe that statement is no longer correct. XSA-182 / QSB #24 come to mind most recently.

[andrewdavidwong]

This would also have to be updated/changed here.

Some options:

• Add a date: "As of [date], there has been only one (!) ..."
• Remove that part.

@marmarek, how do you want to handle it?

[andrewdavidwong]

This would also have to be updated/changed here.

Some options:

• Add a date: "As of [date], there has been only one (!) ..."
• Remove that part.

@marmarek, how do you want to handle it?

[marmarek]

I'd keep that part in place. So - add a date. And maybe update the number anyway, like - "as of 2016, there has been only three publicly disclosed exploitable bug in the Xen"? Or keep the old number and add "as of Sep 2015"...

[marmarek]

I'd keep that part in place. So - add a date. And maybe update the number anyway, like - "as of 2016, there has been only three publicly disclosed exploitable bug in the Xen"? Or keep the old number and add "as of Sep 2015"...