Permissions, Privileges, and Access Controls in Xen - CVE-2015-2151

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU32430

Permissions, Privileges, and Access Controls in Xen - CVE-2015-2151

Published: March 12, 2015 / Updated: July 28, 2020


Vulnerability identifier: #VU32430
CSH Severity: Low
CVSS v4: 8.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2015-2151
CWE-ID: CWE-264
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local non-authenticated attacker to execute arbitrary code.

The x86 emulator in Xen 3.2.x through 4.5.x does not properly ignore segment overrides for instructions with register operands, which allows local guest users to obtain sensitive information, cause a denial of service (memory corruption), or possibly execute arbitrary code via unspecified vectors.


Affected software

Xen
xen (Alpine package)
xen
SUSE Linux
Fedora

How to mitigate CVE-2015-2151

Install update from vendor's website.

xen (Alpine package) - update to 4.5.0-r0
xen - addressed in versions 4.4.1-14.fc21, 4.4.1-15.fc21, 4.4.1-16.fc21, 4.5.0-4.fc22, 4.5.0-5.fc22, 4.5.0-6.fc22

External References

Related Security Bulletins