6

CVE-2015-8551

The PCI backend driver in Xen, when running on an x86 system and using Linux 3.1.x through 4.3.x as the driver domain, allows local guest administrators to hit BUG conditions and cause a denial of service (NULL pointer dereference and host OS crash) by leveraging a system with access to a passed-through MSI or MSI-X capable physical PCI device and a crafted sequence of XEN_PCI_OP_* operations, aka "Linux pciback missing sanity checks."

Data is provided by the National Vulnerability Database (NVD)
Linux ≫ Linux Kernel Version >= 3.1 <= 3.1.10
Linux ≫ Linux Kernel Version >= 4.3.0 <= 4.3.6
Debian ≫ Debian Linux Version7.0
Debian ≫ Debian Linux Version8.0
Opensuse ≫ Opensuse Version13.1
Suse ≫ Linux Enterprise Desktop Version11 Updatesp4
Suse ≫ Linux Enterprise Desktop Version12 Updatesp1
Suse ≫ Linux Enterprise Real Time Extension Version11 Updatesp4
Suse ≫ Linux Enterprise Real Time Extension Version12 Updatesp1
Suse ≫ Linux Enterprise Server Version11 Update-
Suse ≫ Linux Enterprise Server Version11 Updatesp4
Suse ≫ Linux Enterprise Server Version12 Updatesp1
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.07% 0.226
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 6 1.5 4
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H
nvd@nist.gov 4.7 3.4 6.9
AV:L/AC:M/Au:N/C:N/I:N/A:C
CWE-476 NULL Pointer Dereference

The product dereferences a pointer that it expects to be valid but is NULL.

http://www.securityfocus.com/bid/79546
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1034480
Third Party Advisory
VDB Entry