Published: 30/10/2015 Updated: 30/10/2018

CVSS v2 Base Score: 2.1 | Impact Score: 2.9 | Exploitability Score: 3.9

VMScore: 187

Vector: AV:L/AC:L/Au:N/C:N/I:N/A:P

The (1) libxl_set_memory_target function in tools/libxl/libxl.c and (2) libxl__build_post function in tools/libxl/libxl_dom.c in Xen 3.4.x up to and including 4.6.x do not properly calculate the balloon size when using the populate-on-demand (PoD) system, which allows local HVM guest users to cause a denial of service (guest crash) via unspecified vectors related to "heavy memory pressure."

Vulnerable Product	Search on Vulmon	Subscribe to Product
xen xen 3.4.1
xen xen 3.4.2
xen xen 4.0.4
xen xen 4.1.0
xen xen 4.1.1
xen xen 4.2.1
xen xen 4.2.2
xen xen 4.4.1
xen xen 4.5.0
xen xen 3.4.0
xen xen 4.0.2
xen xen 4.0.3
xen xen 4.1.6.1
xen xen 4.2.0
xen xen 4.3.4
xen xen 4.4.0
xen xen 3.4.3
xen xen 3.4.4
xen xen 4.1.2
xen xen 4.1.3
xen xen 4.2.3
xen xen 4.3.0
xen xen 4.5.1
xen xen 4.6.0
xen xen 4.0.0
xen xen 4.0.1
xen xen 4.1.4
xen xen 4.1.5
xen xen 4.3.1
xen xen 4.3.2

Multiple security issues have been found in the Xen virtualisation solution, which may result in denial of service or information disclosure For the oldstable distribution (wheezy), an update will be provided later For the stable distribution (jessie), these problems have been fixed in version 441-9+deb8u3 For the unstable distribution (sid), ...

The (1) libxl_set_memory_target function in tools/libxl/libxlc and (2) libxl__build_post function in tools/libxl/libxl_domc in Xen 34x through 46x do not properly calculate the balloon size when using the populate-on-demand (PoD) system, which allows local HVM guest users to cause a denial of service (guest crash) via unspecified vectors rela ...

CWE-399 http://xenbits.xen.org/xsa/advisory-153.html http://www.securityfocus.com/bid/77365 http://support.citrix.com/article/CTX202404 http://lists.opensuse.org/opensuse-updates/2015-11/msg00063.html http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171249.html http://www.debian.org/security/2015/dsa-3414 http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171185.html http://www.securitytracker.com/id/1034036 http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171082.html https://security.gentoo.org/glsa/201604-03 https://nvd.nist.gov https://www.debian.org/security/./dsa-3414 https://access.redhat.com/security/cve/cve-2015-7972

CVE-2015-7972

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect