CVE-2015-6654

Description

The xenmem_add_to_physmap_one function in arch/arm/mm.c in Xen 4.5.x, 4.4.x, and earlier does not limit the number of printk console messages when reporting a failure to retrieve a reference on a foreign page, which allows remote domains to cause a denial of service by leveraging permissions to map the memory of a foreign guest.

CVSS Metrics

• v2.0•LOW•Score: 2.1AV:L/AC:L/Au:N/C:N/I:N/A:P

EPSS Trends

Current EPSS score: 0.05%• Percentile: 15%

Techniques & Countermeasures

• CWE-264•Permissions, Privileges, and Access Controls

  Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.

Affected Systems

• xen•xen

  4.4.0 | 4.5.0 | 4.5.1

References (3)

• http://xenbits.xen.org/xsa/advisory-141.html
• http://www.debian.org/security/2015/dsa-3414
• http://www.securitytracker.com/id/1033438