PT-2015-5872 · Qemu+2 · Qemu+2
Jan Beulich
·
Publicado
2015-04-01
·
Atualizado
2018-10-30
·
CVE-2015-2756
CVSS v2.0
4.9
Média
| Vetor | AV:L/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
QEMU versions 3.3.x through 4.5.x
Description
The issue is related to improper restriction of access to PCI command registers. This could allow local HVM guest users to cause a denial of service, resulting in a non-maskable interrupt and host crash. The denial of service can be triggered by disabling the memory or I/O decoding for a PCI Express device and then accessing the device, which leads to an Unsupported Request (UR) response.
Recommendations
For QEMU versions 3.3.x through 4.5.x, consider restricting access to PCI command registers to prevent local HVM guest users from causing a denial of service. As a temporary workaround, restrict access to PCI Express devices to minimize the risk of exploitation.
Exploit
Correção
DoS
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Qemu
Suse
Ubuntu