Vulnerability Details : CVE-2015-2150
Xen 3.3.x through 4.5.x and the Linux kernel through 3.19.1 do not properly restrict access to PCI command registers, which might allow local guest OS users to cause a denial of service (non-maskable interrupt and host crash) by disabling the (1) memory or (2) I/O decoding for a PCI Express device and then accessing the device, which triggers an Unsupported Request (UR) response.
Vulnerability category: Denial of service
Products affected by CVE-2015-2150
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
- cpe:2.3:o:ubuntu:ubuntu:12.04:*:lts:*:*:*:*:*
- cpe:2.3:o:xen:xen:3.3.2:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:3.4.1:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:3.3.0:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:3.3.1:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:3.4.3:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:3.4.4:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:4.0.0:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:3.4.0:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:3.4.2:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:4.0.4:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:4.1.0:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:4.0.2:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:4.0.3:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:4.1.1:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:4.0.1:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:4.2.0:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:4.1.2:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:4.1.3:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:4.1.4:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:4.2.1:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:4.2.2:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:4.1.5:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:4.2.3:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:4.3.0:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:4.3.1:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:4.1.6.1:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:4.4.0:rc1:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:4.4.0:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:4.4.1:-:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:4.5.0:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2015-2150
0.06%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 26 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2015-2150
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
4.9
|
MEDIUM | AV:L/AC:L/Au:N/C:N/I:N/A:C |
3.9
|
6.9
|
NIST |
CWE ids for CVE-2015-2150
-
Assigned by: nvd@nist.gov (Primary)
References for CVE-2015-2150
-
http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-423503.htm
Security Advisory - Xen Vulnerabilities on Huawei FusionSphere products
-
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=af6fc858a35b90e89ea7a7ee58e66628c55c776b
kernel/git/torvalds/linux.git - Linux kernel source tree
-
http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00018.html
[security-announce] SUSE-SU-2015:1592-1: important: Security update for
-
http://www.ubuntu.com/usn/USN-2632-1
USN-2632-1: Linux kernel (OMAP4) vulnerabilities | Ubuntu security notices
-
http://www.securitytracker.com/id/1031902
Xen Non-maskable Interrupt Generation Lets Local Guest Users Crash the Host System - SecurityTracker
-
https://github.com/torvalds/linux/commit/af6fc858a35b90e89ea7a7ee58e66628c55c776b
xen-pciback: limit guest control of command register · torvalds/linux@af6fc85 · GitHub
-
http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00001.html
[security-announce] SUSE-SU-2015:0658-1: important: Security Update for
-
http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00021.html
[security-announce] SUSE-SU-2015:1611-1: important: Security update for
-
https://bugzilla.redhat.com/show_bug.cgi?id=1196266
1196266 – (CVE-2015-2150, CVE-2015-8553, xsa120) CVE-2015-2150 CVE-2015-8553 xen: non-maskable interrupts triggerable by guests (xsa120)
-
http://www.ubuntu.com/usn/USN-2631-1
USN-2631-1: Linux kernel vulnerabilities | Ubuntu security notices
-
http://www.debian.org/security/2015/dsa-3237
Debian -- Security Information -- DSA-3237-1 linux
-
http://lists.fedoraproject.org/pipermail/package-announce/2015-March/152747.html
[SECURITY] Fedora 22 Update: kernel-4.0.0-0.rc4.git0.1.fc22
-
http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
Oracle Linux Bulletin - January 2016
-
http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00004.html
[security-announce] SUSE-SU-2015:1478-1: important: Security update for
-
http://www.securitytracker.com/id/1031806
Xen Multiple Flaws Let Local Guest Users Deny Service or Obtain Information From Other Guest Systems - SecurityTracker
-
http://www.securityfocus.com/bid/73014
Xen CVE-2015-2150 Denial of Service Vulnerability
-
http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155854.html
[SECURITY] Fedora 21 Update: kernel-3.19.4-200.fc21
-
http://xenbits.xen.org/xsa/advisory-120.html
XSA-120 - Xen Security AdvisoriesVendor Advisory
-
http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155804.html
[SECURITY] Fedora 20 Update: kernel-3.19.4-100.fc20
-
https://seclists.org/bugtraq/2019/Aug/18
Bugtraq: [SECURITY] [DSA 4497-1] linux security update
-
http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155908.html
[SECURITY] Fedora 22 Update: kernel-4.0.0-1.fc22
Jump to