Published: 30/10/2015 Updated: 30/10/2018

CVSS v2 Base Score: 4.9 | Impact Score: 6.9 | Exploitability Score: 3.9

VMScore: 436

Vector: AV:L/AC:L/Au:N/C:N/I:N/A:C

Multiple memory leaks in Xen 4.0 up to and including 4.6.x allow local guest administrators or domains with certain permission to cause a denial of service (memory consumption) via a large number of "teardowns" of domains with the vcpu pointer array allocated using the (1) XEN_DOMCTL_max_vcpus hypercall or the xenoprofile state vcpu pointer array allocated using the (2) XENOPROF_get_buffer or (3) XENOPROF_set_passive hypercall.

Vulnerable Product	Search on Vulmon	Subscribe to Product
xen xen 4.0.1
xen xen 4.0.2
xen xen 4.1.4
xen xen 4.1.5
xen xen 4.3.2
xen xen 4.3.4
xen xen 4.0.3
xen xen 4.0.4
xen xen 4.1.6.1
xen xen 4.2.0
xen xen 4.2.1
xen xen 4.4.0
xen xen 4.4.1
xen xen 4.1.0
xen xen 4.1.1
xen xen 4.2.2
xen xen 4.2.3
xen xen 4.5.0
xen xen 4.5.1
xen xen 4.0.0
xen xen 4.1.2
xen xen 4.1.3
xen xen 4.3.0
xen xen 4.3.1
xen xen 4.6.0

Multiple security issues have been found in the Xen virtualisation solution, which may result in denial of service or information disclosure For the oldstable distribution (wheezy), an update will be provided later For the stable distribution (jessie), these problems have been fixed in version 441-9+deb8u3 For the unstable distribution (sid), ...

Multiple memory leaks in Xen 40 through 46x allow local guest administrators or domains with certain permission to cause a denial of service (memory consumption) via a large number of "teardowns" of domains with the vcpu pointer array allocated using the (1) XEN_DOMCTL_max_vcpus hypercall or the xenoprofile state vcpu pointer array allocated usi ...

CWE-399 http://xenbits.xen.org/xsa/advisory-149.html http://xenbits.xen.org/xsa/advisory-151.html http://www.securityfocus.com/bid/77364 http://www.securitytracker.com/id/1034033 http://support.citrix.com/article/CTX202404 http://lists.opensuse.org/opensuse-updates/2015-11/msg00063.html http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171249.html http://www.debian.org/security/2015/dsa-3414 http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171185.html http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171082.html https://security.gentoo.org/glsa/201604-03 https://nvd.nist.gov https://www.debian.org/security/./dsa-3414

CVE-2015-7969

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect