CVE-2015-8104
CRITICAL EPSS 82.8%
Published Nov 16, 201510y ago · Modified Jun 17, 20262w ago
10.0 CVSS 3.1
Published Nov 16, 2015 10y ago
Last Modified Jun 17, 2026 2w ago
Description
The KVM subsystem in the Linux kernel through 4.2.6, and Xen 4.3.x through 4.6.x, allows guest OS users to cause a denial of service (host OS panic or hang) by triggering many #DB (aka Debug) exceptions, related to svm.c.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Changed
Confidentiality High
Integrity High
Availability High
Threat Intelligence
EPSS Exploit Probability
82.8% percentile
Exploit & Patch Status
No Known Exploit
Patch Available
Weaknesses 1
CWE-399
Affected Products 30
| Vendor | Product | Version | Range |
|---|---|---|---|
| xen | xen | 4.3.0 | any |
| xen | xen | 4.3.1 | any |
| xen | xen | 4.3.2 | any |
| xen | xen | 4.3.3 | any |
| xen | xen | 4.3.4 | any |
| xen | xen | 4.4.0 | any |
| xen | xen | 4.4.1 | any |
| xen | xen | 4.4.2 | any |
| xen | xen | 4.4.3 | any |
| xen | xen | 4.5.0 | any |
| xen | xen | 4.5.1 | any |
| xen | xen | 4.5.2 | any |
| xen | xen | 4.6.0 | any |
| xen | xen | 4.6.1 | any |
| xen | xen | 4.6.2 | any |
| xen | xen | 4.6.4 | any |
| xen | xen | 4.6.5 | any |
| oracle | solaris | 11.3 | any |
| oracle | vm_virtualbox | * | ≥4.0.0 – ≤4.0.34 |
| oracle | vm_virtualbox | * | ≥4.1.0 – ≤4.1.42 |
| oracle | vm_virtualbox | * | ≥4.2.0 – ≤4.2.34 |
| oracle | vm_virtualbox | * | ≥4.3.0 – ≤4.3.35 |
| oracle | vm_virtualbox | * | ≥5.0.0 – ≤5.0.13 |
| linux | linux_kernel | * | ≤4.2.3 |
| debian | debian_linux | 7.0 | any |
| debian | debian_linux | 8.0 | any |
| debian | debian_linux | 9.0 | any |
| canonical | ubuntu_linux | 12.04 | any |
| canonical | ubuntu_linux | 14.04 | any |
| canonical | ubuntu_linux | 15.04 | any |
References 43
- git.kernel.org http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=cbdb967af3d54993f5814f1cee0ed311a055377d
- lists.fedoraproject.org http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172187.html
- lists.fedoraproject.org http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172300.html
- lists.fedoraproject.org http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172435.html
- lists.opensuse.org http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00035.html
- lists.opensuse.org http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00005.html
- lists.opensuse.org http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00026.html
- lists.opensuse.org http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00031.html
- lists.opensuse.org http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00013.html
- lists.opensuse.org http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00015.html
- lists.opensuse.org http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00038.html
- lists.opensuse.org http://lists.opensuse.org/opensuse-updates/2015-12/msg00039.html
- lists.opensuse.org http://lists.opensuse.org/opensuse-updates/2015-12/msg00053.html
- rhn.redhat.com http://rhn.redhat.com/errata/RHSA-2015-2636.html
- rhn.redhat.com http://rhn.redhat.com/errata/RHSA-2015-2645.html
- rhn.redhat.com http://rhn.redhat.com/errata/RHSA-2016-0046.html
- support.citrix.com http://support.citrix.com/article/CTX202583
- support.citrix.com http://support.citrix.com/article/CTX203879
- debian.org http://www.debian.org/security/2015/dsa-3414
- debian.org http://www.debian.org/security/2015/dsa-3426
- debian.org http://www.debian.org/security/2016/dsa-3454
- openwall.com http://www.openwall.com/lists/oss-security/2015/11/10/5
- openwall.com http://www.openwall.com/lists/oss-security/2023/10/10/4
- oracle.com http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html
- oracle.com http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html
- oracle.com http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- oracle.com http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
- oracle.com http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html
- securityfocus.com http://www.securityfocus.com/bid/77524
- securityfocus.com http://www.securityfocus.com/bid/91787
- securitytracker.com http://www.securitytracker.com/id/1034105
- ubuntu.com http://www.ubuntu.com/usn/USN-2840-1
- ubuntu.com http://www.ubuntu.com/usn/USN-2841-1
- ubuntu.com http://www.ubuntu.com/usn/USN-2841-2
- ubuntu.com http://www.ubuntu.com/usn/USN-2842-1
- ubuntu.com http://www.ubuntu.com/usn/USN-2842-2
- ubuntu.com http://www.ubuntu.com/usn/USN-2843-1
- ubuntu.com http://www.ubuntu.com/usn/USN-2843-2
- ubuntu.com http://www.ubuntu.com/usn/USN-2844-1
- xenbits.xen.org http://xenbits.xen.org/xsa/advisory-156.html
- bugzilla.redhat.com https://bugzilla.redhat.com/show_bug.cgi?id=1278496
- github.com https://github.com/torvalds/linux/commit/cbdb967af3d54993f5814f1cee0ed311a055377d
- kb.juniper.net https://kb.juniper.net/JSA10783
Remediation
- git.kernel.org http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=cbdb967af3d54993f5814f1cee0ed311a055377d
- oracle.com http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html
- oracle.com http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html
- xenbits.xen.org http://xenbits.xen.org/xsa/advisory-156.html
- github.com https://github.com/torvalds/linux/commit/cbdb967af3d54993f5814f1cee0ed311a055377d