CVE-2015-8338
published 2015-12-17CVE-2015-8338: Xen 4.6.x and earlier does not properly enforce limits on page order inputs for the (1) XENMEM_increase_reservation, (2) XENMEM_populate_physmap, (3)…
PriorityP425high7.2CVSS 2.0
AVLACLAuNCCICAC
EPSS
0.42%
34.0th percentile
Xen 4.6.x and earlier does not properly enforce limits on page order inputs for the (1) XENMEM_increase_reservation, (2) XENMEM_populate_physmap, (3) XENMEM_exchange, and possibly other HYPERVISOR_memory_op suboperations, which allows ARM guest OS administrators to cause a denial of service (CPU consumption, guest reboot, or watchdog timeout and host reboot) and possibly have unspecified other impact via unknown vectors.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | xen | < xen 4.8.0~rc3-1 (bookworm) | xen 4.8.0~rc3-1 (bookworm) |
| xen | xen | <= 4.6.0 | — |
| xen | xen | >= 0 < 4.8.0~rc3-1 | 4.8.0~rc3-1 |
| xen | xen | >= 0 < 4.8.0~rc3-1 | 4.8.0~rc3-1 |
| xen | xen | >= 0 < 4.8.0~rc3-1 | 4.8.0~rc3-1 |
| xen | xen | >= 0 < 4.8.0~rc3-1 | 4.8.0~rc3-1 |
CVSS provenance
nvdv2.07.2HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C
osv7.2HIGH
vendor_debian7.2HIGH
vendor_redhat7.2HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
xen: Long running memory operations on ARM cause DoS
vendor_redhat·2015-12-08·CVSS 7.2
CVE-2015-8338 [HIGH] CWE-667 xen: Long running memory operations on ARM cause DoS
xen: Long running memory operations on ARM cause DoS
Xen 4.6.x and earlier does not properly enforce limits on page order inputs for the (1) XENMEM_increase_reservation, (2) XENMEM_populate_physmap, (3) XENMEM_exchange, and possibly other HYPERVISOR_memory_op suboperations, which allows ARM guest OS administrators to cause a denial of service (CPU consumption, guest reboot, or watchdog timeout and host reboot) and possibly have unspecified other impact via unknown vectors.
A flaw was discovered in xen host that prevented the use of a physical CPU for a significant period of time. This can cause a softlockup or watchdog timeout in both the host and other guests.
Statement: This issue does not affect the Linux kernel packages as shipped with Red Hat Enterprise Linux 5, 6, and 7, Red Hat E
Debian
CVE-2015-8338: xen - Xen 4.6.x and earlier does not properly enforce limits on page order inputs for ...
vendor_debian·2015·CVSS 7.2
CVE-2015-8338 [HIGH] CVE-2015-8338: xen - Xen 4.6.x and earlier does not properly enforce limits on page order inputs for ...
Xen 4.6.x and earlier does not properly enforce limits on page order inputs for the (1) XENMEM_increase_reservation, (2) XENMEM_populate_physmap, (3) XENMEM_exchange, and possibly other HYPERVISOR_memory_op suboperations, which allows ARM guest OS administrators to cause a denial of service (CPU consumption, guest reboot, or watchdog timeout and host reboot) and possibly have unspecified other impact via unknown vectors.
Scope: local
bookworm: resolved (fixed in 4.8.0~rc3-1)
bullseye: resolved (fixed in 4.8.0~rc3-1)
forky: resolved (fixed in 4.8.0~rc3-1)
sid: resolved (fixed in 4.8.0~rc3-1)
trixie: resolved (fixed in 4.8.0~rc3-1)
GHSA
GHSA-2h27-hv8q-h9cg: Xen 4
ghsa_unreviewed·2022-05-17
CVE-2015-8338 [HIGH] GHSA-2h27-hv8q-h9cg: Xen 4
Xen 4.6.x and earlier does not properly enforce limits on page order inputs for the (1) XENMEM_increase_reservation, (2) XENMEM_populate_physmap, (3) XENMEM_exchange, and possibly other HYPERVISOR_memory_op suboperations, which allows ARM guest OS administrators to cause a denial of service (CPU consumption, guest reboot, or watchdog timeout and host reboot) and possibly have unspecified other impact via unknown vectors.
OSV
CVE-2015-8338: Xen 4
osv·2015-12-17·CVSS 7.2
CVE-2015-8338 [HIGH] CVE-2015-8338: Xen 4
Xen 4.6.x and earlier does not properly enforce limits on page order inputs for the (1) XENMEM_increase_reservation, (2) XENMEM_populate_physmap, (3) XENMEM_exchange, and possibly other HYPERVISOR_memory_op suboperations, which allows ARM guest OS administrators to cause a denial of service (CPU consumption, guest reboot, or watchdog timeout and host reboot) and possibly have unspecified other impact via unknown vectors.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2015-8338 CVE-2015-8339 CVE-2015-8340 CVE-2015-8341 xen: various flaws [fedora-all]
bugzilla·2015-12-08·CVSS 7.2
CVE-2015-8338 [HIGH] CVE-2015-8338 CVE-2015-8339 CVE-2015-8340 CVE-2015-8341 xen: various flaws [fedora-all]
CVE-2015-8338 CVE-2015-8339 CVE-2015-8340 CVE-2015-8341 xen: various flaws [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported ve
Bugzilla
CVE-2015-8338 xen: Long running memory operations on ARM cause DoS
bugzilla·2015-11-24·CVSS 7.2
CVE-2015-8338 [HIGH] CVE-2015-8338 xen: Long running memory operations on ARM cause DoS
CVE-2015-8338 xen: Long running memory operations on ARM cause DoS
Certain HYPERVISOR_memory_op subops take page order inputs, with so far insufficient enforcement of limits thereof. In particular, for all of XENMEM_increase_reservation, XENMEM_populate_physmap, and XENMEM_exchange the order was limited to 9 only for guests without physical devices assigned. Guests with assigned devices were allowed up to order 18 (x86) or 20 (ARM). XENMEM_decrease_reservation enforced only the latter, higher limit uniformly on all kinds of guests.
All of these operations involve loops over individual pages (possibly nested, with only the iteration count of the innermost loop being of interest here), resulting in iteration counts of up to 1 million on ARM. Total execution time of these operations obvious
http://www.debian.org/security/2016/dsa-3633http://www.securityfocus.com/bid/78920http://www.securitytracker.com/id/1034390http://xenbits.xen.org/xsa/advisory-158.htmlhttp://www.debian.org/security/2016/dsa-3633http://www.securityfocus.com/bid/78920http://www.securitytracker.com/id/1034390http://xenbits.xen.org/xsa/advisory-158.html
2015-12-17
Published