CVE-2015-8341

Description

The libxl toolstack library in Xen 4.1.x through 4.6.x does not properly release mappings of files used as kernels and initial ramdisks when managing multiple domains in the same process, which allows attackers to cause a denial of service (memory and disk consumption) by starting domains.

CVSS Metrics

• v2.0•HIGH•Score: 7.8AV:N/AC:L/Au:N/C:N/I:N/A:C

EPSS Trends

Current EPSS score: 0.54%• Percentile: 68%

Techniques & Countermeasures

• CWE-399•Resource Management Errors

  Weaknesses in this category are related to improper management of system resources.

Affected Systems

• xen•xen

  4.1.0 | 4.1.1 | 4.1.2 | 4.1.3 | 4.1.4 | 4.1.5 | 4.1.6 | 4.1.6.1 | 4.2.0 | 4.2.1 | 4.2.2 | 4.2.3 | 4.2.4 | 4.2.5 | 4.3.0 | 4.3.1 | 4.3.2 | 4.3.3 | 4.3.4 | 4.4.0 | 4.4.1 | 4.4.2 | 4.4.3 | 4.5.0 | 4.5.1 | 4.5.2 | 4.6.0

References (4)

• http://www.debian.org/security/2016/dsa-3519
• http://xenbits.xen.org/xsa/advisory-160.html
• http://www.securitytracker.com/id/1034389
• https://security.gentoo.org/glsa/201604-03