Vulnerability Details : CVE-2015-8341
The libxl toolstack library in Xen 4.1.x through 4.6.x does not properly release mappings of files used as kernels and initial ramdisks when managing multiple domains in the same process, which allows attackers to cause a denial of service (memory and disk consumption) by starting domains.
Vulnerability category: Denial of service
Products affected by CVE-2015-8341
- cpe:2.3:o:xen:xen:4.1.0:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:4.1.1:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:4.2.0:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:4.1.2:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:4.1.3:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:4.1.4:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:4.2.1:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:4.2.2:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:4.1.5:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:4.2.3:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:4.3.0:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:4.3.1:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:4.1.6.1:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:4.3.2:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:4.4.0:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:4.4.1:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:4.2.4:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:4.2.5:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:4.3.3:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:4.5.0:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:4.3.4:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:4.4.2:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:4.5.1:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:4.4.3:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:4.6.0:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:4.5.2:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:4.1.6:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2015-8341
0.87%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 73 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2015-8341
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
7.8
|
HIGH | AV:N/AC:L/Au:N/C:N/I:N/A:C |
10.0
|
6.9
|
NIST |
CWE ids for CVE-2015-8341
-
Assigned by: nvd@nist.gov (Primary)
References for CVE-2015-8341
-
http://xenbits.xen.org/xsa/advisory-160.html
XSA-160 - Xen Security AdvisoriesVendor Advisory
-
https://security.gentoo.org/glsa/201604-03
Xen: Multiple vulnerabilities (GLSA 201604-03) — Gentoo security
-
http://www.debian.org/security/2016/dsa-3519
Debian -- Security Information -- DSA-3519-1 xen
-
http://www.securitytracker.com/id/1034389
Xen libxl Error Conditions Let Local Users on a Guest System Cause Denial of Service Conditions on the Host System - SecurityTracker
Jump to