PT-2015-5632 · Xen+1 · Xen+1

Sander Eikelenboom · Published 2015-03-09 · Updated 2018-10-30 · CVE-2015-2152

Positive Technologies (AI Summary)

CVSS v2.0

1.9

Low

Base vector

AV:L/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Xen versions 4.5.x and earlier

Description The issue allows local guest users to obtain access to the VGA console. This can be achieved by setting the DISPLAY environment variable when compiled with SDL support, or by connecting to the VNC server on ::1 or 127.0.0.1 when not compiled with SDL support.

Recommendations For Xen versions 4.5.x and earlier, consider disabling the VGA console emulation for x86 HVM guests as a temporary workaround until a patch is available. Restrict access to the VNC server to minimize the risk of exploitation. Avoid using the DISPLAY environment variable in affected configurations until the issue is resolved.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2015-2152

MGASA-2016-0098

OPENSUSE-SU-2015_0732-1

OPENSUSE-SU-2015_1092-1

SUSE-SU-2015:0613-1

Affected Products

Suse

Xen

References · 139

• 🔥 https://github.com/vincentbernat/cve-2015-3456 · Exploit
• https://osv.dev/vulnerability/MGASA-2016-0098 · Vendor Advisory
• https://security.gentoo.org/glsa/201504-04 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2016-0098.html · Security Note
• http://xenbits.xen.org/xsa/advisory-119.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-10460 · Security Note
• https://bdu.fstec.ru/vul/2015-10395 · Security Note
• https://bdu.fstec.ru/vul/2015-10459 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2015-2152 · Security Note
• https://bdu.fstec.ru/vul/2015-07329 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00014.html · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2015-March/152588.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2015-2152 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2015-2152 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-07330 · Security Note