CVE-2013-4494: Debian Linux

Medium severity, CVSS 5.2. EPSS: 0.7% chance of exploitation in the next 30 days.

Xen before 4.1.x, 4.2.x, and 4.3.x does not take the page_alloc_lock and grant_table.lock in the same order, which allows local guest administrators with access to multiple vcpus to cause a denial of service (host deadlock) via unspecified vectors.

Affected products

• Debian Debian Linux: version 7.0 only
• Xen Xen: from 4.1.0, up to and including 4.1.6.1; from 4.2.0, up to and including 4.2.5; from 4.3.0, up to and including 4.3.4

Published 2013-11-02. Last modified 2026-06-16.