PT-2015-5867 · Xen+1 · Xen+1

Andrew Cooper · Published 2015-04-01 · Updated 2018-10-30 · CVE-2015-2751

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Xen versions 4.3.x through 4.5.x

Description The issue allows remote domains with partial management control to cause a denial of service, resulting in a host lock, through unspecified domctl operations when toolstack disaggregation is used.

Recommendations For Xen versions 4.3.x through 4.5.x, as a temporary workaround, consider restricting access to domctl operations to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Weakness Enumeration

CWE-17

Related Identifiers

CVE-2015-2751

MGASA-2016-0098

OPENSUSE-SU-2015_1092-1

OPENSUSE-SU-2015_1094-1

SUSE-SU-2015:0701-1

SUSE-SU-2015:0923-1

SUSE-SU-2015:1479-1

SUSE-SU-2015:1479-2

SUSE-SU-2015_0701-1

SUSE-SU-2015_1479-1

SUSE-SU-2015_1479-2

Affected Products

Suse

Xen

References · 158

• 🔥 https://github.com/vincentbernat/cve-2015-3456 · Exploit
• https://osv.dev/vulnerability/MGASA-2016-0098 · Vendor Advisory
• https://security.gentoo.org/glsa/201504-04 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2016-0098.html · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00018.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2015-2751 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-10460 · Security Note
• https://bdu.fstec.ru/vul/2015-10395 · Security Note
• https://bdu.fstec.ru/vul/2015-10459 · Security Note
• https://bdu.fstec.ru/vul/2015-07329 · Security Note
• https://bdu.fstec.ru/vul/2015-11313 · Security Note
• http://xenbits.xen.org/xsa/advisory-127.html · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154579.html · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2015:1479-2 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2015-2751 · Vendor Advisory