CVE-2015-2045 — Sensitive Information Exposure in XEN

CWE-200 — Sensitive Information ExposureCWE-212 — Improper Removal of Sensitive Information Before Storage or Transfer6 documents6 sources
Severity
2.1LOWNVD
EPSS
0.1%
top 77.22%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
XENDebian XENDebian Linux+1 more
Timeline
PublishedMar 12
Latest updateMay 14

Description

The HYPERVISOR_xen_version hypercall in Xen 3.2.x through 4.5.x does not properly initialize data structures, which allows local guest users to obtain sensitive information via unspecified vectors.

CVSS vector

AV:L/AC:L/C:P/I:N/A:NExploitability: 3.9 | Impact: 2.9

Affected Packages3 packages

▶debiandebian/xen< xen 4.4.1-8 (bookworm)
▶Debianxen/xen< 4.4.1-8+3
▶NVDxen/xen33 versions+32

Also affects: Debian Linux 7.0, Fedora 20, 21, 22

Patches

Patch: xenbits.xen.org ↗Patch: xenbits.xen.org ↗

🔴Vulnerability Details

2
GHSA
GHSA-hp7f-c7cj-cfg9: The HYPERVISOR_xen_version hypercall in Xen 3↗2022-05-14
▶
OSV
CVE-2015-2045: The HYPERVISOR_xen_version hypercall in Xen 3↗2015-03-12
▶

📋Vendor Advisories

2
Red Hat
xen: information leak via version information hypercall (XSA-122)↗2015-03-06
▶
Debian
CVE-2015-2045: xen - The HYPERVISOR_xen_version hypercall in Xen 3.2.x through 4.5.x does not properl...↗2015
▶

💬Community

1
Bugzilla
CVE-2015-2045 xen: information leak via version information hypercall (XSA-122)↗2015-02-23
▶