PT-2015-5867 · Xen+1 · Xen+1

Andrew Cooper · Publicado 2015-04-01 · Atualizado 2018-10-30 · CVE-2015-2751

Positive Technologies (AI Summary)

CVSS v2.0

7.1

Alta

Vetor base

AV:N/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Xen versions 4.3.x through 4.5.x

Description The issue allows remote domains with partial management control to cause a denial of service, resulting in a host lock, through unspecified domctl operations when toolstack disaggregation is used.

Recommendations For Xen versions 4.3.x through 4.5.x, as a temporary workaround, consider restricting access to domctl operations to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Enumeração de Fraquezas

CWE-17

Identificadores relacionados

CVE-2015-2751

MGASA-2016-0098

OPENSUSE-SU-2015_1092-1

OPENSUSE-SU-2015_1094-1

SUSE-SU-2015:0701-1

SUSE-SU-2015:0923-1

SUSE-SU-2015:1479-1

SUSE-SU-2015:1479-2

SUSE-SU-2015_0701-1

SUSE-SU-2015_1479-1

SUSE-SU-2015_1479-2

Produtos afetados

Suse

Xen

Referências · 158

• 🔥 https://github.com/vincentbernat/cve-2015-3456 · Exploit
• https://bugzilla.suse.com/912011 · Nota
• http://xenbits.xen.org/xsa/advisory-118.html · Nota
• https://suse.com/security/cve/CVE-2015-5165 · Nota
• https://bugzilla.suse.com/921842 · Nota
• http://xenbits.xen.org/xsa/advisory-164.html · Nota
• https://osv.dev/vulnerability/MGASA-2016-0098 · Aviso do Fabricante
• http://xenbits.xen.org/xsa/advisory-120.html · Nota
• https://bugzilla.suse.com/935634 · Nota
• https://suse.com/security/cve/CVE-2015-4164.html · Nota
• https://suse.com/security/cve/CVE-2015-2751.html · Nota
• http://lists.suse.com/mailman/listinfo/sle-security-updates · Nota
• https://security.gentoo.org/glsa/201504-04 · Aviso do Fabricante
• https://bugzilla.suse.com/903680 · Nota
• https://suse.com/support/update/announcement/2015/suse-su-20150923-1 · Nota