PT-2015-5565 · Xen+1 · Xen+1

Jan Beulich · Published 2015-03-09 · Updated 2018-10-30 · CVE-2015-2044

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Xen versions 3.2.x through 4.5.x

Description The issue concerns the emulation routines for unspecified X86 devices in Xen, which do not properly initialize data. This allows local HVM guest users to obtain sensitive information via vectors involving an unsupported access size.

Recommendations For Xen versions 3.2.x through 4.5.x, update to a version that properly initializes data in the emulation routines for X86 devices to prevent local HVM guest users from obtaining sensitive information.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2015-2044

DSA-3181-1

MGASA-2016-0098

OPENSUSE-SU-2015_0732-1

OPENSUSE-SU-2015_1092-1

SUSE-SU-2015:0613-1

SUSE-SU-2015:0745-1

SUSE-SU-2015:0746-1

SUSE-SU-2015:0747-1

SUSE-SU-2015_0745-1

SUSE-SU-2015_0746-1

SUSE-SU-2015_0747-1

Affected Products

Suse

Xen

References · 159

• 🔥 https://github.com/vincentbernat/cve-2015-3456 · Exploit
• https://ubuntu.com/security/CVE-2015-2044 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2016-0098 · Vendor Advisory
• https://security.gentoo.org/glsa/201504-04 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2016-0098.html · Security Note
• https://bdu.fstec.ru/vul/2015-10460 · Security Note
• https://security-tracker.debian.org/tracker/source-package/xen · Vendor Advisory
• http://debian.org/security/2015/dsa-3181 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2015-2044 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-10395 · Security Note
• https://bdu.fstec.ru/vul/2015-10459 · Security Note
• https://bdu.fstec.ru/vul/2015-07329 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00014.html · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2015-March/152588.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/DSA-3181-1 · Vendor Advisory