PT-2015-7634 · Xen+1 · Xen+1
好风
+1
·
Publicado
2015-10-29
·
Atualizado
2024-06-15
·
CVE-2015-7835
CVSS v2.0
7.2
Alta
| Vetor | AV:L/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Xen versions 3.4 through 4.6.x
Description
The issue arises from the
mod l2 entry function in arch/x86/mm.c, which fails to properly validate level 2 page table entries. This allows local PV guest administrators to gain privileges by creating a crafted superpage mapping.Recommendations
For Xen versions 3.4 through 4.6.x, consider restricting access to the
mod l2 entry function until a patch is available. As a temporary workaround, limit the creation of superpage mappings to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.RCE
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Suse
Xen