CVE-2015-4104 — Deserialization of Untrusted Data in Qemu

CWE-264CWE-502 — Deserialization of Untrusted DataCWE-20 — Improper Input Validation13 documents8 sources
Severity
7.8HIGHNVD
GHSA10.0GHSA7.5OSV7.5
EPSS
8.4%
top 7.65%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
QemuXENDebian Qemu+1 more
Timeline
PublishedJun 3
Latest updateMay 17

Description

Xen 3.3.x through 4.5.x does not properly restrict access to PCI MSI mask bits, which allows local x86 HVM guest users to cause a denial of service (unexpected interrupt and host crash) via unspecified vectors.

CVSS vector

AV:N/AC:L/C:N/I:N/A:CExploitability: 10.0 | Impact: 6.9

Affected Packages6 packages

▶debiandebian/xen< qemu 1:2.3+dfsg-5 (bookworm)
▶debiandebian/qemu< qemu 1:2.3+dfsg-5 (bookworm)
▶Debianxen/xen< 4.4.0-1+3
▶Debianqemu/qemu< 1:2.3+dfsg-5+3
▶Ubuntuqemu/qemu< 2.0.0+dfsg-2ubuntu1.13

🔴Vulnerability Details

5
GHSA
GHSA-mcww-78xg-3cx3: Xen 3↗2022-05-17
▶
GHSA
Deserialization of Untrusted Data in Log4j 1.x↗2022-01-21
▶
GHSA
JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data↗2021-12-14
▶
OSV
qemu, qemu-kvm vulnerabilities↗2015-06-10
▶
OSV
CVE-2015-4104: Xen 3↗2015-06-03
▶

📋Vendor Advisories

3
Ubuntu
QEMU vulnerabilities↗2015-06-10
▶
Red Hat
xen: PCI MSI mask bits inadvertently exposed to guests (xsa-129)↗2015-06-02
▶
Debian
CVE-2015-4104: qemu - Xen 3.3.x through 4.5.x does not properly restrict access to PCI MSI mask bits, ...↗2015
▶

💬Community

2
Bugzilla
CVE-2015-4104 xen: PCI MSI mask bits inadvertently exposed to guests (xsa-129) [fedora-all]↗2015-06-03
▶
Bugzilla
CVE-2015-4104 xen: PCI MSI mask bits inadvertently exposed to guests (xsa-129)↗2015-05-21
▶