CVE-2015-4103: Medium severity xen xapi vulnerability

Published Jun 3, 2015

Updated

Xen 3.3.x through 4.5.x does not properly restrict write access to the host MSI message data field, which allows local x86 HVM guest administrators to cause a denial of service (host interrupt handling confusion) via vectors related to qemu and accessing spanning multiple fields.

Affected Software

30 affected components

XEN Xen=3.3.0

XEN Xen=3.3.1

XEN Xen=3.3.2

XEN Xen=3.4.0

XEN Xen=3.4.1

XEN Xen=3.4.2

XEN Xen=3.4.3

XEN Xen=3.4.4

XEN Xen=4.0.1

XEN Xen=4.0.2

XEN Xen=4.0.3

XEN Xen=4.0.4

XEN Xen=4.1.0

XEN Xen=4.1.1

XEN Xen=4.1.2

XEN Xen=4.1.3

XEN Xen=4.1.4

XEN Xen=4.1.5

XEN Xen=4.1.6.1

XEN Xen=4.2.0

XEN Xen=4.2.1

XEN Xen=4.2.2

XEN Xen=4.2.3

XEN Xen=4.3.0

XEN Xen=4.3.1

XEN Xen=4.3.2

XEN Xen=4.3.4

XEN Xen=4.4.0

XEN Xen=4.4.1

XEN Xen=4.5.0

Event History

Jun 3, 2015

CVE Published

via MITRE·08:00 PM

Data Sourced

via MITRE·08:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2015-4103?

CVE-2015-4103 has a severity rating that can result in a denial of service due to improper write access restrictions.

How do I fix CVE-2015-4103?

To fix CVE-2015-4103, users should upgrade to the latest patched version of Xen that addresses this vulnerability.

Which versions of Xen are affected by CVE-2015-4103?

CVE-2015-4103 affects Xen versions from 3.3.x through 4.5.x.

What kind of attack can exploit CVE-2015-4103?

CVE-2015-4103 can be exploited by local x86 HVM guest administrators to disrupt host interrupt handling.

Is there a workaround for CVE-2015-4103?

Currently, there are no official workarounds for CVE-2015-4103, so upgrading is the recommended action.