CVE-2015-6654: Low severity xen xapi vulnerability

Published Sep 3, 2015

Updated

The xenmemaddtophysmapone function in arch/arm/mm.c in Xen 4.5.x, 4.4.x, and earlier does not limit the number of printk console messages when reporting a failure to retrieve a reference on a foreign page, which allows remote domains to cause a denial of service by leveraging permissions to map the memory of a foreign guest.

Affected Software

3 affected components

XEN Xen=4.4.0

XEN Xen=4.5.0

XEN Xen=4.5.1

Remediation

Patch Available

http://xenbits.xen.org/xsa/advisory-141.html

Event History

Sep 3, 2015

CVE Published

via MITRE·02:00 PM

Data Sourced

via MITRE·02:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2015-6654?

CVE-2015-6654 has a medium severity rating due to its potential to cause a denial of service.

How do I fix CVE-2015-6654?

To mitigate CVE-2015-6654, upgrade to a fixed version of Xen that is not affected by this vulnerability.

What systems are affected by CVE-2015-6654?

CVE-2015-6654 affects Xen versions 4.4.0, 4.5.0, and 4.5.1.

What type of vulnerability is CVE-2015-6654?

CVE-2015-6654 is a denial of service vulnerability that allows remote domains to affect system stability.

Can CVE-2015-6654 be exploited remotely?

Yes, CVE-2015-6654 can be exploited remotely by leveraging permissions to map foreign pages.