Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact
9.3
CVSSv2

CVE-2015-5165

Published: 12/08/2015 Updated: 13/02/2023
CVSS v2 Base Score: 9.3 | Impact Score: 10 | Exploitability Score: 8.6
VMScore: 829
Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C
Subscribe to Xen

Vulnerability Summary

The C+ mode offload emulation in the RTL8139 network card device model in QEMU, as used in Xen 4.5.x and previous versions, allows remote malicious users to read process heap memory via unspecified vectors.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

xen xen

xen xen 4.5.1

fedoraproject fedora 22

fedoraproject fedora 21

suse linux enterprise server 11

suse linux enterprise server 10

suse linux enterprise debuginfo 11

debian debian linux 8.0

debian debian linux 7.0

redhat enterprise linux for scientific computing 6.0

redhat enterprise linux workstation 7.0

redhat enterprise linux for scientific computing 7.0

redhat openstack 5.0

redhat enterprise linux server 7.0

redhat enterprise linux eus 6.7

redhat enterprise linux server eus 7.2

redhat enterprise linux for power big endian eus 7.1_ppc64

redhat enterprise linux server eus 7.1

redhat enterprise linux desktop 6.0

redhat enterprise linux server 6.0

redhat enterprise linux for power big endian 6.0

redhat enterprise linux workstation 6.0

redhat enterprise linux server tus 7.3

redhat enterprise linux compute node eus 7.1

redhat enterprise linux for power big endian 7.0

redhat openstack 6.0

redhat enterprise linux server aus 7.3

redhat enterprise linux server aus 7.4

redhat enterprise linux server eus 7.3

redhat enterprise linux server eus 7.4

redhat enterprise linux server eus 7.5

redhat virtualization 3.0

redhat enterprise linux server tus 7.6

redhat enterprise linux server eus 7.6

redhat enterprise linux server aus 7.6

redhat enterprise linux server eus 7.7

redhat enterprise linux server aus 7.7

redhat enterprise linux server tus 7.7

redhat enterprise linux server update services for sap solutions 7.6

redhat enterprise linux server update services for sap solutions 7.7

redhat enterprise linux server update services for sap solutions 7.4

redhat enterprise linux server update services for sap solutions 7.3

redhat enterprise linux for power big endian eus 7.2_ppc64

redhat enterprise linux compute node eus 7.2

redhat enterprise linux compute node eus 7.3

redhat enterprise linux compute node eus 7.4

redhat enterprise linux compute node eus 7.5

redhat enterprise linux compute node eus 7.6

redhat enterprise linux compute node eus 7.7

redhat enterprise linux server update services for sap solutions 7.2

redhat enterprise linux for power big endian eus 7.3_ppc64

redhat enterprise linux for power big endian eus 7.4_ppc64

redhat enterprise linux for power big endian eus 7.5_ppc64

redhat enterprise linux for power big endian eus 7.6_ppc64

redhat enterprise linux for power big endian eus 7.7_ppc64

redhat enterprise linux server eus from rhui 6.7

redhat enterprise linux server from rhui 7.0

redhat enterprise linux for power big endian eus 6.7_ppc64

redhat enterprise linux eus compute node 6.7

redhat enterprise linux server from rhui 6.0

arista eos 4.15

arista eos 4.14

arista eos 4.13

arista eos 4.12

oracle linux 7

Vendor Advisories

Ubuntu Security Notice: qemu, qemu-kvm vulnerabilities
Several security issues were fixed in QEMU ...
Debian Security Advisories: DSA-3349-1 qemu-kvm -- security update
Several vulnerabilities were discovered in qemu-kvm, a full virtualization solution on x86 hardware CVE-2015-5165 Donghai Zhu discovered that the QEMU model of the RTL8139 network card did not sufficiently validate inputs in the C+ mode offload emulation, allowing a malicious guest to read uninitialized memory from the QEMU proces ...
Debian Security Advisories: DSA-3348-1 qemu -- security update
Several vulnerabilities were discovered in qemu, a fast processor emulator CVE-2015-3214 Matt Tait of Google's Project Zero security team discovered a flaw in the QEMU i8254 PIT emulation A privileged guest user in a guest with QEMU PIT emulation enabled could potentially use this flaw to execute arbitrary code on the host with t ...
Debian CVElist Bug Report Logs: qemu: CVE-2015-5166: Use after free in QEMU/Xen block unplug protocol
Debian Bug report logs - #794611 qemu: CVE-2015-5166: Use after free in QEMU/Xen block unplug protocol Package: src:qemu; Maintainer for src:qemu is Debian QEMU Team <pkg-qemu-devel@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Tue, 4 Aug 2015 20:27:02 UTC Severity: important ...
Debian CVElist Bug Report Logs: qemu: CVE-2015-5154: ide: atapi: heap overflow during I/O buffer memory access
Debian Bug report logs - #793811 qemu: CVE-2015-5154: ide: atapi: heap overflow during I/O buffer memory access Package: src:qemu; Maintainer for src:qemu is Debian QEMU Team <pkg-qemu-devel@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Mon, 27 Jul 2015 18:12:02 UTC Severity: g ...
Debian CVElist Bug Report Logs: qemu: CVE-2015-3214: i8254: out-of-bounds memory access in pit_ioport_read function
Debian Bug report logs - #795461 qemu: CVE-2015-3214: i8254: out-of-bounds memory access in pit_ioport_read function Package: src:qemu; Maintainer for src:qemu is Debian QEMU Team <pkg-qemu-devel@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Fri, 14 Aug 2015 08:12:10 UTC Severi ...
Debian CVElist Bug Report Logs: qemu: CVE-2015-5158: scsi stack buffer overflow
Debian Bug report logs - #793388 qemu: CVE-2015-5158: scsi stack buffer overflow Package: src:qemu; Maintainer for src:qemu is Debian QEMU Team <pkg-qemu-devel@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Thu, 23 Jul 2015 15:06:03 UTC Severity: important Tags: patch, security, ...
Debian CVElist Bug Report Logs: qemu: CVE-2015-5165: rtl8139 uninitialized heap memory information leakage to guest
Debian Bug report logs - #794610 qemu: CVE-2015-5165: rtl8139 uninitialized heap memory information leakage to guest Package: src:qemu; Maintainer for src:qemu is Debian QEMU Team <pkg-qemu-devel@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Tue, 4 Aug 2015 20:24:02 UTC Severi ...
Debian CVElist Bug Report Logs: qemu: CVE-2015-5745: buffer overflow in virtio-serial
Debian Bug report logs - #795087 qemu: CVE-2015-5745: buffer overflow in virtio-serial Package: src:qemu; Maintainer for src:qemu is Debian QEMU Team <pkg-qemu-devel@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Mon, 10 Aug 2015 13:24:06 UTC Severity: normal Tags: fixed-upstrea ...
Debian CVElist Bug Report Logs: qemu: CVE-2015-5225: ui: vnc: heap memory corruption in vnc_refresh_server_surface
Debian Bug report logs - #796465 qemu: CVE-2015-5225: ui: vnc: heap memory corruption in vnc_refresh_server_surface Package: src:qemu; Maintainer for src:qemu is Debian QEMU Team <pkg-qemu-devel@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Fri, 21 Aug 2015 22:12:02 UTC Severit ...
Red Hat: CVE-2015-5165
An information leak flaw was found in the way QEMU's RTL8139 emulation implementation processed network packets under RTL8139 controller's C+ mode of operation An unprivileged guest user could use this flaw to read up to 65 KB of uninitialized QEMU heap memory ...

Github Repositories

https://github.com/SplendidSky/vm_escape

vm_escape CVE-2015-7504 and CVE-2015-5165

https://github.com/tina2114/skr_learn_list

skr_learn_list

这是什么？ 这是一份skr_university的学习清单，因为太菜被抓，努力学习的一份记录 skr_learn_list 前面因为年代久远，就以周为单位，后面再以日为单位 第一周（2020518-2020523）：Prime c++和stl源码剖析（视频+代码） Prime c++：第一章到第六章 前面和prime c没什么太大的区别，就暂且不进行

https://github.com/ashishdas009/dynamic-syscall-filtering-for-qemu

dynamic-syscall-filtering-for-qemu Quick Emulator (QEMU) is a generic and open source machine emulator and virtualizer It has become a de facto tool in industry for virtualization in cloud Therefore, security for QEMU becomes one of the topmost priorities for organizations running cloud environments around the world Secure Computing mode (Seccomp) is one such library which p

Recent Articles

QEMU may be fro-Xen out after two new bugs emerge
The Register • Simon Sharwood • 04 Aug 2015

Five guest-host escalation SNAFUs might be stretching the virtual friendship

The Xen project has revealed another two bugs in the QEMU hypervisor and is now wondering the extent to which it should support the buggy code. The first of the flaws, CVE-2015-5165, means “A guest may be able to read sensitive host-level data relating to itself which resides in the QEMU process” and impacts “All Xen systems running x86 HVM guests without stubdomains which have been configured with an emulated RTL8139 driver mode”. There's a workaround and the Xen team are asking you to ...

Read more...

References

CWE-908http://xenbits.xen.org/xsa/advisory-140.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2015-September/167820.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2015-September/167792.htmlhttp://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.htmlhttp://www.securityfocus.com/bid/76153http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00027.htmlhttp://support.citrix.com/article/CTX201717http://rhn.redhat.com/errata/RHSA-2015-1833.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1793.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1740.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1739.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2015-September/165373.htmlhttp://www.securitytracker.com/id/1033176http://rhn.redhat.com/errata/RHSA-2015-1683.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1674.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-08/msg00018.htmlhttp://www.debian.org/security/2015/dsa-3349http://www.debian.org/security/2015/dsa-3348https://www.arista.com/en/support/advisories-notices/security-advisories/1180-security-advisory-13https://usn.ubuntu.com/2724-1/https://nvd.nist.govhttps://access.redhat.com/security/cve/cve-2015-5165
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-27977IMAPlocal usersCVE-2024-32038CVE-2023-49963CVE-2023-22869CVE-2024-31497localCVE-2024-2961
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook