PT-2015-7307 · Xen · Xen

Julien Grall · Publicado 2015-09-03 · Atualizado 2016-12-07 · CVE-2015-6654

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Baixa

Vetor base

AV:L/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Xen versions 4.5.x, 4.4.x, and earlier

Description The issue is related to the xenmem add to physmap one function in arch/arm/mm.c, which does not limit the number of printk console messages when reporting a failure to retrieve a reference on a foreign page. This allows remote domains to cause a denial of service by leveraging permissions to map the memory of a foreign guest.

Recommendations For Xen versions 4.5.x, 4.4.x, and earlier, consider restricting permissions to map the memory of a foreign guest to minimize the risk of exploitation. As a temporary workaround, consider limiting the number of printk console messages to prevent a denial of service.

Correção

DoS

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2015-6654

DSA-3414-1

MGASA-2016-0098

Produtos afetados

Xen

Referências · 83

• https://ubuntu.com/security/CVE-2015-6654 · Aviso do Fabricante
• http://debian.org/security/2015/dsa-3414 · Aviso do Fabricante
• http://xenbits.xen.org/xsa/advisory-141.html · Aviso do Fabricante
• http://xenbits.xen.org/xsa/advisory-118.html · Nota
• http://xenbits.xen.org/xsa/advisory-148.html · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3259 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7970 · Nota de Segurança
• http://xenbits.xen.org/xsa/advisory-164.html · Nota
• https://osv.dev/vulnerability/MGASA-2016-0098 · Aviso do Fabricante
• http://xenbits.xen.org/xsa/advisory-120.html · Nota
• https://cve.org/CVERecord?id=CVE-2015-6654 · Nota de Segurança
• https://bdu.fstec.ru/vul/2015-12106 · Nota de Segurança
• http://xenbits.xen.org/xsa/advisory-124.html · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7971 · Nota de Segurança
• http://xenbits.xen.org/xsa/advisory-146.html · Nota