CVE-2015-4105 — Qemu vulnerability

CWE-3998 documents7 sources
Severity
4.9MEDIUMNVD
OSV7.5
EPSS
0.1%
top 68.83%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
QemuXENDebian Qemu+1 more
Timeline
PublishedJun 3
Latest updateMay 17

Description

Xen 3.3.x through 4.5.x enables logging for PCI MSI-X pass-through error messages, which allows local x86 HVM guests to cause a denial of service (host disk consumption) via certain invalid operations.

CVSS vector

AV:L/AC:L/C:N/I:N/A:CExploitability: 3.9 | Impact: 6.9

Affected Packages6 packages

▶debiandebian/xen< qemu 1:2.3+dfsg-5 (bookworm)
▶debiandebian/qemu< qemu 1:2.3+dfsg-5 (bookworm)
▶Debianxen/xen< 4.4.0-1+3
▶Debianqemu/qemu< 1:2.3+dfsg-5+3
▶Ubuntuqemu/qemu< 2.0.0+dfsg-2ubuntu1.13

🔴Vulnerability Details

3
GHSA
GHSA-p4g5-x4m6-rpr2: Xen 3↗2022-05-17
▶
OSV
qemu, qemu-kvm vulnerabilities↗2015-06-10
▶
OSV
CVE-2015-4105: Xen 3↗2015-06-03
▶

📋Vendor Advisories

3
Ubuntu
QEMU vulnerabilities↗2015-06-10
▶
Red Hat
xen: guest triggerable qemu MSI-X pass-through error messages (xsa-130)↗2015-06-02
▶
Debian
CVE-2015-4105: qemu - Xen 3.3.x through 4.5.x enables logging for PCI MSI-X pass-through error message...↗2015
▶

💬Community

1
Bugzilla
CVE-2015-4105 xen: guest triggerable qemu MSI-X pass-through error messages (xsa-130) [fedora-all]↗2015-06-03
▶