Published: 01/04/2015 Updated: 30/10/2018

CVSS v2 Base Score: 4.9 | Impact Score: 6.9 | Exploitability Score: 3.9

VMScore: 436

Vector: AV:L/AC:L/Au:N/C:N/I:N/A:C

The XEN_DOMCTL_memory_mapping hypercall in Xen 3.2.x up to and including 4.5.x, when using a PCI passthrough device, is not preemptible, which allows local x86 HVM domain users to cause a denial of service (host CPU consumption) via a crafted request to the device model (qemu-dm).

Vulnerable Product	Search on Vulmon	Subscribe to Product
fedoraproject fedora 20
fedoraproject fedora 21
xen xen 4.3.0
xen xen 4.3.1
xen xen 4.3.2
xen xen 4.4.0
xen xen 4.4.1
xen xen 4.5.0

Debian Bug report logs - #781620 CVE-2015-2751 CVE-2015-2752 CVE-2015-2756 Package: src:xen; Maintainer for src:xen is Debian Xen Team <pkg-xen-devel@listsaliothdebianorg>; Reported by: Moritz Muehlenhoff <jmm@debianorg> Date: Tue, 31 Mar 2015 17:15:02 UTC Severity: important Tags: fixed-upstream, security, upstr ...

Debian Bug report logs - #780975 CVE-2015-2152 Package: src:xen; Maintainer for src:xen is Debian Xen Team <pkg-xen-devel@listsaliothdebianorg>; Reported by: Moritz Muehlenhoff <jmm@debianorg> Date: Sun, 22 Mar 2015 18:03:01 UTC Severity: important Tags: security Fixed in version xen/441-9 Done: Bastian Blank ...

The XEN_DOMCTL_memory_mapping hypercall in Xen 32x through 45x, when using a PCI passthrough device, is not preemptible, which allows local x86 HVM domain users to cause a denial of service (host CPU consumption) via a crafted request to the device model (qemu-dm) ...

CWE-20 http://xenbits.xen.org/xsa/advisory-125.html http://www.securitytracker.com/id/1031994 http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154579.html http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154574.html http://www.securityfocus.com/bid/73448 https://security.gentoo.org/glsa/201504-04 http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00018.html http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00014.html http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155198.html https://nvd.nist.gov https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=894847 https://access.redhat.com/security/cve/cve-2015-2752

CVE-2015-2752

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect