PT-2013-4430 · Xen+2 · Xen+2

Gábor Pék · Published 2013-08-28 · Updated 2024-06-15 · CVE-2013-3495

Positive Technologies (AI Summary)

CVSS v2.0

4.7

Medium

Base vector

AV:L/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Xen versions 3.3.x through 4.3.x

Description The issue allows local guests to cause a denial of service, resulting in a kernel panic. This is achieved by sending a malformed Message Signaled Interrupt (MSI) from a PCI device capable of bus mastering, which triggers a System Error Reporting (SERR) Non-Maskable Interrupt (NMI).

Recommendations For Xen versions 3.3.x through 4.3.x, consider disabling the Interrupt Remapping engine as a temporary workaround until a patch is available. Restrict access to PCI devices that are bus mastering capable to minimize the risk of exploitation.

Fix

DoS

Weakness Enumeration

CWE-264

Related Identifiers

ALT-PU-2014-1616

ALT-PU-2014-1683

CVE-2013-3495

OPENSUSE-SU-2015_0226-1

OPENSUSE-SU-2015_0256-1

OPENSUSE-SU-2024:10196-1

SUSE-SU-2014_1710-1

SUSE-SU-2014_1732-1

SUSE-SU-2015:0940-1

SUSE-SU-2015_0022-1

SUSE-SU-2015_0744-1

Affected Products

Alt Linux

Suse

Xen

References · 234

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9065 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3495 · Security Note
• https://osv.dev/vulnerability/CVE-2013-3495 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10196-1 · Vendor Advisory
• https://security.gentoo.org/glsa/201504-04 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2599 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00010.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-3495 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5149 · Security Note
• https://errata.altlinux.org/ALT-PU-2014-1616 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5146 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3124 · Security Note
• https://bdu.fstec.ru/vul/2015-07329 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2013-3495 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3615 · Security Note