Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2015-8551

The PCI backend driver in Xen, when running on an x86 system and using Linux 3.1.x through 4.3.x as the driver domain, allows local guest administrators to hit BUG conditions and cause a denial of service (NULL pointer dereference and host OS crash) by leveraging a system with access to a passed-through MSI or MSI-X capable physical PCI device and a crafted sequence of XEN_PCI_OP_* operations, aka "Linux pciback missing sanity checks."

Published

2016-04-13T15:59:05.257

Last Modified

2025-04-12T10:46:40.837

Status

Deferred

Source

[email protected]

Severity

CVSSv3.1: 6.0 (MEDIUM)

CVSSv2 Vector

AV:L/AC:M/Au:N/C:N/I:N/A:C

  • Access Vector: LOCAL
  • Access Complexity: MEDIUM
  • Authentication: NONE
  • Confidentiality Impact: NONE
  • Integrity Impact: NONE
  • Availability Impact: COMPLETE
Exploitability Score

3.4

Impact Score

6.9

Weaknesses
  • Type: Primary
    CWE-476
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Operating System linux linux_kernel ≤ 3.1.10 Yes
Operating System linux linux_kernel ≤ 4.3.6 Yes
Operating System debian debian_linux 7.0 Yes
Operating System debian debian_linux 8.0 Yes
Operating System opensuse opensuse 13.1 Yes
Operating System suse linux_enterprise_desktop 11 Yes
Operating System suse linux_enterprise_desktop 12 Yes
Operating System suse linux_enterprise_real_time_extension 11 Yes
Operating System suse linux_enterprise_real_time_extension 12 Yes
Operating System suse linux_enterprise_server 11 Yes
Operating System suse linux_enterprise_server 11 Yes
Operating System suse linux_enterprise_server 12 Yes
Operating System suse linux_enterprise_software_development_kit 11 Yes
Operating System suse linux_enterprise_software_development_kit 12 Yes
Operating System suse linux_enterprise_workstation_extension 12 Yes
References