CVSS2
Attack Vector
LOCAL
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
COMPLETE
AV:L/AC:M/Au:N/C:N/I:N/A:C
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H
AI Score
Confidence
High
EPSS
Percentile
26.7%
The PCI backend driver in Xen, when running on an x86 system and using Linux 3.1.x through 4.3.x as the driver domain, allows local guest administrators to hit BUG conditions and cause a denial of service (NULL pointer dereference and host OS crash) by leveraging a system with access to a passed-through MSI or MSI-X capable physical PCI device and a crafted sequence of XEN_PCI_OP_* operations, aka “Linux pciback missing sanity checks.”
Vendor | Product | Version | CPE |
---|---|---|---|
linux | linux_kernel | * | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
debian | debian_linux | 7.0 | cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:* |
debian | debian_linux | 8.0 | cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* |
opensuse | opensuse | 13.1 | cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:* |
suse | linux_enterprise_desktop | 11 | cpe:2.3:o:suse:linux_enterprise_desktop:11:sp4:*:*:*:*:*:* |
suse | linux_enterprise_desktop | 12 | cpe:2.3:o:suse:linux_enterprise_desktop:12:sp1:*:*:*:*:*:* |
suse | linux_enterprise_real_time_extension | 11 | cpe:2.3:o:suse:linux_enterprise_real_time_extension:11:sp4:*:*:*:*:*:* |
suse | linux_enterprise_real_time_extension | 12 | cpe:2.3:o:suse:linux_enterprise_real_time_extension:12:sp1:*:*:*:*:*:* |
suse | linux_enterprise_server | 11 | cpe:2.3:o:suse:linux_enterprise_server:11:-:*:*:*:*:*:* |
suse | linux_enterprise_server | 11 | cpe:2.3:o:suse:linux_enterprise_server:11:sp4:*:*:*:*:*:* |
lists.opensuse.org/opensuse-security-announce/2016-03/msg00094.html
lists.opensuse.org/opensuse-security-announce/2016-04/msg00045.html
lists.opensuse.org/opensuse-security-announce/2016-06/msg00059.html
lists.opensuse.org/opensuse-security-announce/2016-07/msg00005.html
lists.opensuse.org/opensuse-security-announce/2016-08/msg00000.html
lists.opensuse.org/opensuse-security-announce/2016-08/msg00044.html
lists.opensuse.org/opensuse-security-announce/2016-08/msg00055.html
www.debian.org/security/2016/dsa-3434
www.securityfocus.com/bid/79546
www.securitytracker.com/id/1034480
xenbits.xen.org/xsa/advisory-157.html
security.gentoo.org/glsa/201604-03
CVSS2
Attack Vector
LOCAL
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
COMPLETE
AV:L/AC:M/Au:N/C:N/I:N/A:C
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H
AI Score
Confidence
High
EPSS
Percentile
26.7%