PT-2015-7767 · Xen+1 · Xen+1

Jan Beulich + 1 · Published 2015-12-17 · Updated 2024-06-15 · CVE-2015-8339

Positive Technologies (AI Summary)

CVSS v2.0

4.7

Medium

Base vector

AV:L/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Xen versions 3.2.x through 4.6.x

Description The issue is related to the memory exchange function in common/memory.c, which does not properly hand back pages to a domain. This could allow guest OS administrators to cause a denial of service, potentially leading to a host crash, via unspecified vectors related to domain teardown.

Recommendations For Xen versions 3.2.x through 4.6.x, consider restricting access to the memory exchange function until a patch is available. As a temporary workaround, limiting domain teardown operations may help minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Weakness Enumeration

CWE-19

Related Identifiers

CVE-2015-8339

DLA-479-1

DSA-3519-1

MGASA-2016-0098

OPENSUSE-SU-2016_0123-1

OPENSUSE-SU-2016_0124-1

OPENSUSE-SU-2016_0126-1

OPENSUSE-SU-2024:10196-1

SUSE-SU-2015:2306-1

SUSE-SU-2015:2324-1

SUSE-SU-2015:2326-1

SUSE-SU-2015:2328-1

SUSE-SU-2015:2338-1

Affected Products

Suse

Xen

References · 263

• https://osv.dev/vulnerability/openSUSE-SU-2024:10196-1 · Vendor Advisory
• http://xenbits.xen.org/xsa/advisory-159.html · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2016-0098 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2271 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2015-8339 · Security Note
• https://advisories.mageia.org/MGASA-2016-0098.html · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2270 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8341 · Security Note
• https://bdu.fstec.ru/vul/2016-00004 · Security Note
• https://osv.dev/vulnerability/DSA-3519-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/source-package/xen · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8550 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2015:2326-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8339 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2015:2324-1 · Vendor Advisory