PT-2015-1969 · Qemu+3 · Qemu+3
Donghai Zhu
·
Publicado
2015-08-11
·
Atualizado
2018-10-30
·
CVE-2015-5166
CVSS v2.0
7.2
Alta
| Vetor | AV:L/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Xen versions 4.5.x and earlier
QEMU (affected versions not specified)
Description
The issue is related to insufficient access control in the QEMU component of the Xen hypervisor, allowing a local attacker to gain privileges by exploiting a use-after-free vulnerability. This can be achieved by unplugging a block device twice, which may enable the attacker to perform actions such as disconnecting block devices.
Recommendations
For Xen versions 4.5.x and earlier, consider restricting access to the block device unplugging functionality until a patch is available.
As a temporary workaround, avoid unplugging block devices twice in the affected QEMU component to minimize the risk of exploitation.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Qemu
Suse
Ubuntu
Xen