4.7
CVSSv2

CVE-2015-8104

Published: 16/11/2015 Updated: 10/10/2023
CVSS v2 Base Score: 4.7 | Impact Score: 6.9 | Exploitability Score: 3.4
VMScore: 419
Vector: AV:L/AC:M/Au:N/C:N/I:N/A:C

Vulnerability Summary

The KVM subsystem in the Linux kernel up to and including 4.2.6, and Xen 4.3.x up to and including 4.6.x, allows guest OS users to cause a denial of service (host OS panic or hang) by triggering many #DB (aka Debug) exceptions, related to svm.c.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

xen xen 4.3.2

xen xen 4.6.0

xen xen 4.3.3

xen xen 4.6.4

xen xen 4.3.0

xen xen 4.5.2

xen xen 4.4.2

xen xen 4.4.3

xen xen 4.6.1

xen xen 4.6.2

xen xen 4.3.4

xen xen 4.5.1

xen xen 4.4.1

xen xen 4.3.1

xen xen 4.5.0

xen xen 4.4.0

xen xen 4.6.5

oracle solaris 11.3

oracle vm virtualbox

linux linux kernel

debian debian linux 8.0

debian debian linux 7.0

debian debian linux 9.0

canonical ubuntu linux 12.04

canonical ubuntu linux 14.04

canonical ubuntu linux 15.04

Vendor Advisories

Debian Bug report logs - #823620 Multiple security issues Package: src:xen; Maintainer for src:xen is Debian Xen Team <pkg-xen-devel@listsaliothdebianorg>; Reported by: Moritz Muehlenhoff <jmm@debianorg> Date: Fri, 6 May 2016 18:03:02 UTC Severity: grave Tags: security Fixed in versions xen/480~rc3-1, xen/48 ...
Synopsis Important: kernel security and bug fix update Type/Severity Security Advisory: Important Topic Updated kernel packages that fix two security issues, several bugs, and addone enhancement are now available for Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as having Importa ...
Synopsis Important: kernel security and bug fix update Type/Severity Security Advisory: Important Topic Updated kernel packages that fix two security issues and two bugs are nowavailable for Red Hat Enterprise Linux 65 Advanced Update SupportRed Hat Product Security has rated this update as having Importa ...
Synopsis Important: kernel security update Type/Severity Security Advisory: Important Topic Updated kernel packages that fix two security issues are now available forRed Hat Enterprise Linux 64 Advanced Update SupportRed Hat Product Security has rated this update as having Important securityimpact Common ...
Synopsis Important: kernel security and bug fix update Type/Severity Security Advisory: Important Topic Updated kernel packages that fix multiple security issues and several bugsare now available for Red Hat Enterprise Linux 6Red Hat Product Security has rated this update as having Important securityimpact ...
Multiple security issues have been found in the Xen virtualisation solution, which may result in denial of service or information disclosure For the oldstable distribution (wheezy), an update will be provided later For the stable distribution (jessie), these problems have been fixed in version 441-9+deb8u3 For the unstable distribution (sid), ...
Multiple vulnerabilities have been discovered in VirtualBox, an x86 virtualisation solution Upstream support for the 41 release series has ended and since no information is available which would allow backports of isolated security fixes, security support for virtualbox in wheezy/oldstable needed to be ended as well If you use virtualbox with ex ...
Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service, information leak or data loss CVE-2013-7446 Dmitry Vyukov discovered that a particular sequence of valid operations on local (AF_UNIX) sockets can result in a use-after-free This may be used to cause a denial o ...
Several security issues were fixed in the kernel ...
Several security issues were fixed in the kernel ...
Several security issues were fixed in the kernel ...
Several security issues were fixed in the kernel ...
Several security issues were fixed in the kernel ...
Several security issues were fixed in the kernel ...
Several security issues were fixed in the kernel ...
Several security issues were fixed in the kernel ...
It was found that the x86 ISA (Instruction Set Architecture) is prone to a denial of service attack inside a virtualized environment in the form of an infinite loop in the microcode due to the way (sequential) delivering of benign exceptions such as #DB (debug exception) is handled A privileged user inside a guest could use this flaw to create den ...

References

CWE-399http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=cbdb967af3d54993f5814f1cee0ed311a055377dhttp://www.openwall.com/lists/oss-security/2015/11/10/5https://bugzilla.redhat.com/show_bug.cgi?id=1278496http://xenbits.xen.org/xsa/advisory-156.htmlhttps://github.com/torvalds/linux/commit/cbdb967af3d54993f5814f1cee0ed311a055377dhttp://support.citrix.com/article/CTX203879http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.htmlhttp://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.htmlhttp://www.securityfocus.com/bid/91787http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.htmlhttp://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.htmlhttp://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.htmlhttp://www.securityfocus.com/bid/77524http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00038.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-04/msg00015.htmlhttp://rhn.redhat.com/errata/RHSA-2016-0046.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-02/msg00013.htmlhttp://www.ubuntu.com/usn/USN-2843-1http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172435.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-11/msg00035.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-12/msg00005.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-12/msg00026.htmlhttp://www.securitytracker.com/id/1034105http://www.ubuntu.com/usn/USN-2841-1http://www.debian.org/security/2016/dsa-3454http://rhn.redhat.com/errata/RHSA-2015-2636.htmlhttp://www.ubuntu.com/usn/USN-2843-2http://support.citrix.com/article/CTX202583http://www.debian.org/security/2015/dsa-3426http://lists.opensuse.org/opensuse-updates/2015-12/msg00039.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2015-November/172300.htmlhttp://www.debian.org/security/2015/dsa-3414http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172187.htmlhttp://www.ubuntu.com/usn/USN-2842-1http://www.ubuntu.com/usn/USN-2844-1http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00031.htmlhttp://www.ubuntu.com/usn/USN-2842-2http://www.ubuntu.com/usn/USN-2841-2http://lists.opensuse.org/opensuse-updates/2015-12/msg00053.htmlhttp://rhn.redhat.com/errata/RHSA-2015-2645.htmlhttp://www.ubuntu.com/usn/USN-2840-1https://kb.juniper.net/JSA10783http://www.openwall.com/lists/oss-security/2023/10/10/4https://nvd.nist.govhttps://bugs.debian.org/cgi-bin/bugreport.cgi?bug=823620https://usn.ubuntu.com/2840-1/https://access.redhat.com/security/cve/cve-2015-8104https://www.debian.org/security/./dsa-3414