Published: 13/04/2016 Updated: 04/11/2017

CVSS v2 Base Score: 1.7 | Impact Score: 2.9 | Exploitability Score: 3.1

CVSS v3 Base Score: 4.4 | Impact Score: 3.6 | Exploitability Score: 0.8

VMScore: 151

Vector: AV:L/AC:L/Au:S/C:N/I:N/A:P

The PCI backend driver in Xen, when running on an x86 system and using Linux 3.1.x up to and including 4.3.x as the driver domain, allows local guest administrators to generate a continuous stream of WARN messages and cause a denial of service (disk consumption) by leveraging a system with access to a passed-through MSI or MSI-X capable physical PCI device and XEN_PCI_OP_enable_msi operations, aka "Linux pciback missing sanity checks."

Vulnerable Product	Search on Vulmon	Subscribe to Product
xen xen 4.3.3
xen xen 4.3.2
xen xen 4.2.1
xen xen 4.2.0
xen xen 4.1.0
xen xen 4.0.4
xen xen 3.4.2
xen xen 3.4.1
xen xen 3.2.1
xen xen 3.2.0
xen xen 4.3.1
xen xen 4.3.0
xen xen 4.1.6.1
xen xen 4.1.6
xen xen 4.0.3
xen xen 4.0.2
xen xen 3.4.0
xen xen 3.3.2
xen xen 3.1.4
xen xen 3.1.3
xen xen 4.2.5
xen xen 4.2.4
xen xen 4.1.5
xen xen 4.1.4
xen xen 4.0.1
xen xen 4.0.0
xen xen 3.3.1
xen xen 3.3.0
xen xen 4.3.4
xen xen 4.2.3
xen xen 4.2.2
xen xen 4.1.3
xen xen 4.1.2
xen xen 4.1.1
xen xen 3.4.4
xen xen 3.4.3
xen xen 3.2.3
xen xen 3.2.2
debian debian linux 6.0
canonical ubuntu linux 12.04
novell suse linux enterprise real time extension 11
novell suse linux enterprise real time extension 12
novell suse linux enterprise debuginfo 11

The PCI backend driver in Xen, when running on an x86 system and using Linux 31x through 43x as the driver domain, allows local guest administrators to generate a continuous stream of WARN messages and cause a denial of service (disk consumption) by leveraging a system with access to a passed-through MSI or MSI-X capable physical PCI device and ...

Several security issues were fixed in the kernel ...

CWE-20 http://xenbits.xen.org/xsa/advisory-157.html http://www.securityfocus.com/bid/79546 http://www.securitytracker.com/id/1034480 http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00059.html http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00005.html http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00000.html http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00055.html http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00044.html http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00094.html http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00045.html https://security.gentoo.org/glsa/201604-03 http://www.debian.org/security/2016/dsa-3434 https://nvd.nist.gov https://access.redhat.com/security/cve/cve-2015-8552 https://usn.ubuntu.com/2854-1/

CVE-2015-8552

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect