PT-2015-1425 · Xen+1 · Xen+1

Jan Beulich · Published 2015-06-03 · Updated 2018-10-30 · CVE-2015-4163

Positive Technologies (AI Summary)

CVSS v2.0

4.9

Medium

Base vector

AV:L/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Xen versions 4.2 through 4.5

Description The issue is related to the GNTTABOP swap grant ref function in Xen, which does not check the grant table operation version. This allows local guest domains to cause a denial of service via a hypercall without a GNTTABOP setup table or GNTTABOP set version. The vulnerability is associated with pointer dereference errors. An attacker, acting locally, can exploit this issue to cause a denial of service by creating a hypercall to the GNTTABOP setup table or GNTTABOP set version functions.

Recommendations For Xen versions 4.2 through 4.5, consider disabling the GNTTABOP swap grant ref function as a temporary workaround until a patch is available. Restrict access to the GNTTABOP setup table and GNTTABOP set version functions to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

BDU:2015-10521

CVE-2015-4163

DSA-3286-1

MGASA-2016-0098

OPENSUSE-SU-2015_1092-1

OPENSUSE-SU-2015_1094-1

SUSE-SU-2015:1042-1

SUSE-SU-2015:1045-1

SUSE-SU-2015:1157-1

Affected Products

Suse

Xen

References · 147

• 🔥 https://github.com/vincentbernat/cve-2015-3456 · Exploit
• https://osv.dev/vulnerability/MGASA-2016-0098 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4164 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2015-4163 · Security Note
• http://xenbits.xen.org/xsa/advisory-134.html · Vendor Advisory
• https://advisories.mageia.org/MGASA-2016-0098.html · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3209 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00004.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00030.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-10460 · Security Note
• https://security-tracker.debian.org/tracker/source-package/xen · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-10395 · Security Note
• https://bdu.fstec.ru/vul/2015-10459 · Security Note
• https://bdu.fstec.ru/vul/2015-07329 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00007.html · Vendor Advisory