Published: 30/10/2015 Updated: 30/10/2018

CVSS v2 Base Score: 7.2 | Impact Score: 10 | Exploitability Score: 3.9

VMScore: 641

Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C

The mod_l2_entry function in arch/x86/mm.c in Xen 3.4 up to and including 4.6.x does not properly validate level 2 page table entries, which allows local PV guest administrators to gain privileges via a crafted superpage mapping.

Vulnerable Product	Search on Vulmon	Subscribe to Product
xen xen 3.4.0
xen xen 3.4.1
xen xen 4.0.3
xen xen 4.0.4
xen xen 4.1.0
xen xen 4.2.0
xen xen 4.2.1
xen xen 4.4.0
xen xen 4.4.1
xen xen 3.4.2
xen xen 3.4.3
xen xen 4.1.1
xen xen 4.1.2
xen xen 4.2.2
xen xen 4.2.3
xen xen 4.5.0
xen xen 4.5.1
xen xen 3.4.4
xen xen 4.0.0
xen xen 4.1.3
xen xen 4.1.4
xen xen 4.3.0
xen xen 4.3.1
xen xen 4.6.0
xen xen 4.0.1
xen xen 4.0.2
xen xen 4.1.5
xen xen 4.1.6.1
xen xen 4.3.2
xen xen 4.3.4

It was discovered that the code to validate level 2 page table entries is bypassed when certain conditions are satisfied A malicious PV guest administrator can take advantage of this flaw to gain privileges via a crafted superpage mapping For the oldstable distribution (wheezy), this problem has been fixed in version 414-3+deb7u9 For the stabl ...

The mod_l2_entry function in arch/x86/mmc in Xen 34 through 46x does not properly validate level 2 page table entries, which allows local PV guest administrators to gain privileges via a crafted superpage mapping ...

CWE-264 CWE-20 http://xenbits.xen.org/xsa/advisory-148.html https://github.com/QubesOS/qubes-secpack/blob/master/QSBs/qsb-022-2015.txt http://www.securityfocus.com/bid/77366 http://support.citrix.com/article/CTX202404 http://lists.opensuse.org/opensuse-updates/2015-11/msg00063.html http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171249.html http://www.securitytracker.com/id/1034032 http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171185.html http://www.debian.org/security/2015/dsa-3390 http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171082.html http://lists.opensuse.org/opensuse-updates/2015-12/msg00053.html https://security.gentoo.org/glsa/201604-03 https://nvd.nist.gov https://www.debian.org/security/./dsa-3390 https://access.redhat.com/security/cve/cve-2015-7835

CVE-2015-7835

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect