PT-2015-2907 · Xen+1 · Xen+1

George Dunlap · Published 2015-12-08 · Updated 2024-06-15 · CVE-2015-8341

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Xen versions 4.1.x through 4.6.x

Description The issue is related to the libxl toolstack library in Xen, which does not properly release mappings of files used as kernels and initial ramdisks when managing multiple domains in the same process. This allows attackers to cause a denial of service by consuming memory and disk space through starting domains.

Recommendations For Xen versions 4.1.x through 4.6.x, consider restricting the management of multiple domains in the same process to minimize the risk of exploitation. As a temporary workaround, consider limiting the number of domains that can be started in the same process until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Weakness Enumeration

CWE-399

Related Identifiers

BDU:2016-00004

CVE-2015-8341

DSA-3519-1

OPENSUSE-SU-2016_0123-1

OPENSUSE-SU-2016_0124-1

OPENSUSE-SU-2016_0126-1

OPENSUSE-SU-2024:10196-1

SUSE-SU-2015:2324-1

SUSE-SU-2015:2326-1

SUSE-SU-2015:2328-1

SUSE-SU-2015:2338-1

Affected Products

Suse

Xen

References · 206

• https://ubuntu.com/security/CVE-2015-8341 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10196-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2271 · Security Note
• http://xenbits.xen.org/xsa/advisory-160.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2270 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8341 · Security Note
• https://bdu.fstec.ru/vul/2016-00004 · Security Note
• https://osv.dev/vulnerability/DSA-3519-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-8341 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2015-8341 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2015-8341 · Security Note
• https://security-tracker.debian.org/tracker/source-package/xen · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8550 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2015:2326-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8339 · Security Note