Information disclosure in Xen - CVE-2015-2044
Published: March 12, 2015 / Updated: July 28, 2020
Vulnerability identifier: #VU32428
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2015-2044
CWE-ID: CWE-200
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vendor: Xen Project
Affected software:
Xen
Xen
Detailed vulnerability description
The vulnerability allows a local non-authenticated attacker to gain access to sensitive information.
The emulation routines for unspecified X86 devices in Xen 3.2.x through 4.5.x does not properly initialize data, which allow local HVM guest users to obtain sensitive information via vectors involving an unsupported access size.
How to mitigate CVE-2015-2044
Install update from vendor's website.
Sources
- http://lists.fedoraproject.org/pipermail/package-announce/2015-March/152483.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-March/152588.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-March/152776.html
- http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00014.html
- http://support.citrix.com/article/CTX200484
- http://www.debian.org/security/2015/dsa-3181
- http://www.securityfocus.com/bid/72954
- http://www.securitytracker.com/id/1031806
- http://www.securitytracker.com/id/1031836
- http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-423503.htm
- http://xenbits.xen.org/xsa/advisory-121.html
- https://security.gentoo.org/glsa/201504-04