medium
6
CWE
476
Advisory Published
CVE Published
Updated

CVE-2015-8551: Null Pointer Dereference

First published: Mon Dec 07 2015(Updated: )

ISSUE DESCRIPTION ================= Xen PCI backend driver does not perform proper sanity checks on the device's state. Which in turn allows the generic MSI code (called by Xen PCI backend) to be called incorrectly leading to hitting BUG conditions or causing NULL pointer exceptions in the MSI code. To exploit this the guest can craft specific sequence of XEN_PCI_OP_* operations which will trigger this. Furthermore the frontend can also craft an continous stream of XEN_PCI_OP_enable_msi which will trigger an continous stream of WARN() messages triggered by the MSI code leading to the logging in the initial domain to exhaust disk space. Lastly there is also missing check to verify whether the device has memory decoding enabled set at the start of the day leading the initial domain "accesses to the respective MMIO or I/O port ranges would - - on PCI Express devices - [which can] lead to Unsupported Request responses. The treatment of such errors is platform specific." (from XSA-120). Note that if XSA-120 'addendum' patch has been applied this particular sub-issue is not exploitable. IMPACT ====== Malicious guest administrators can cause denial of service. If driver domains are not in use, the impact is a host crash. Only x86 systems are vulnerable. ARM systems are not vulnerable. VULNERABLE SYSTEMS ================== This bug affects systems using Linux as the driver domain, including non-disaggregated systems using Linux as dom0. Linux versions v3.1 and onwards are vulnerable due to supporting PCI pass-through backend driver. PV and HVM guests which have been granted access to physical PCI devices (`PCI passthrough') can take advantage of this vulnerability. Furthermore, the vulnerability is only applicable when the passed-through PCI devices are MSI-capable or MSI-X. (Most modern devices are). MITIGATION ========== Not using PCI passthrough for PV and HVM guests. Note that for HVM guests QEMU is used for PCI passthrough - however the toolstack sets up also the 'PV' PCI which the guest can utilize if it chooses to do so. External References: <a href="http://xenbits.xen.org/xsa/advisory-157.html">http://xenbits.xen.org/xsa/advisory-157.html</a> Acknowledgements: Red Hat would like to thank the Xen project for reporting this issue.

Credit: cve@mitre.org cve@mitre.org

Affected SoftwareAffected VersionHow to fix
Linux Linux kernel>=3.1<=3.1.10
Linux Linux kernel>=4.3.0<=4.3.6
Debian Debian Linux=7.0
Debian Debian Linux=8.0
openSUSE openSUSE=13.1
SUSE Linux Enterprise Desktop=11-sp4
SUSE Linux Enterprise Desktop=12-sp1
Suse Linux Enterprise Real Time Extension=11-sp4
Suse Linux Enterprise Real Time Extension=12-sp1
SUSE Linux Enterprise Server=11
SUSE Linux Enterprise Server=11-sp4
SUSE Linux Enterprise Server=12-sp1
SUSE Linux Enterprise Software Development Kit=11-sp4
SUSE Linux Enterprise Software Development Kit=12-sp1
Suse Linux Enterprise Workstation Extension=12-sp1
debian/linux
5.10.223-1
5.10.226-1
6.1.115-1
6.1.112-1
6.11.7-1
6.11.9-1

Remedy

https://git.kernel.org/linus/1da177e4c3f41524e886b7f1b8a0c1fc7321cac2

Remedy

https://git.kernel.org/linus/56441f3c8e5bd45aab10dd9f8c505dd4bec03b0d

Remedy

https://git.kernel.org/linus/5e0ce1455c09dd61d029b8ad45d82e1ac0b6c4c9

Remedy

https://git.kernel.org/linus/a396f3a210c3a61e94d6b87ec05a75d0be2a60d0

Remedy

https://git.kernel.org/linus/7cfb905b9638982862f0331b36ccaaca5d383b49

Remedy

https://git.kernel.org/linus/408fb0e5aa7fda0059db282ff58c3b2a4278baa0

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Frequently Asked Questions

  • What is the vulnerability ID?

    The vulnerability ID is CVE-2015-8551.

  • What is the severity of CVE-2015-8551?

    The severity of CVE-2015-8551 is medium.

  • What is the affected software for CVE-2015-8551?

    The affected software for CVE-2015-8551 includes Linux versions 3.1.x through 4.3.x when running on an x86 system with Xen as the driver domain.

  • How does CVE-2015-8551 impact the system?

    CVE-2015-8551 can cause a denial of service (NULL pointer dereference and host OS crash) on the host system by leveraging a system with access to a passed-through PCI device.

  • What is the fix for CVE-2015-8551?

    The fix for CVE-2015-8551 is to update the Linux kernel to a version that includes the necessary security patches.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2024 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203