CVE-2015-4103 — Qemu vulnerability

CWE-2649 documents7 sources
Severity
4.9MEDIUMNVD
OSV7.5
EPSS
0.1%
top 68.83%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
QemuXENDebian Qemu+1 more
Timeline
PublishedJun 3
Latest updateMay 17

Description

Xen 3.3.x through 4.5.x does not properly restrict write access to the host MSI message data field, which allows local x86 HVM guest administrators to cause a denial of service (host interrupt handling confusion) via vectors related to qemu and accessing spanning multiple fields.

CVSS vector

AV:L/AC:L/C:N/I:N/A:CExploitability: 3.9 | Impact: 6.9

Affected Packages6 packages

▶debiandebian/qemu< qemu 1:2.3+dfsg-5 (bookworm)
▶Debianqemu/qemu< 1:2.3+dfsg-5+3
▶Ubuntuqemu/qemu< 2.0.0+dfsg-2ubuntu1.13
▶debiandebian/xen< qemu 1:2.3+dfsg-5 (bookworm)
▶Debianxen/xen< 4.4.0-1+3

🔴Vulnerability Details

3
GHSA
GHSA-pgcx-wwx7-v778: Xen 3↗2022-05-17
▶
OSV
qemu, qemu-kvm vulnerabilities↗2015-06-10
▶
OSV
CVE-2015-4103: Xen 3↗2015-06-03
▶

📋Vendor Advisories

3
Ubuntu
QEMU vulnerabilities↗2015-06-10
▶
Red Hat
xen: potential unintended writes to host MSI message data field via qemu (xsa-128)↗2015-06-02
▶
Debian
CVE-2015-4103: qemu - Xen 3.3.x through 4.5.x does not properly restrict write access to the host MSI ...↗2015
▶

💬Community

2
Bugzilla
CVE-2015-4103 xen: potential unintended writes to host MSI message data field via qemu (xsa-128) [fedora-all]↗2015-06-03
▶
Bugzilla
CVE-2015-4103 xen: potential unintended writes to host MSI message data field via qemu (xsa-128)↗2015-05-21
▶