Lucene search

K
freebsdFreeBSDCE658051-27EA-11E5-A4A5-002590263BF5
HistoryApr 20, 2015 - 12:00 a.m.

xen-kernel -- Information leak through XEN_DOMCTL_gettscinfo

2015-04-2000:00:00
vuxml.freebsd.org
11

2.9 Low

CVSS2

Access Vector

ADJACENT_NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:A/AC:M/Au:N/C:P/I:N/A:N

0.001 Low

EPSS

Percentile

50.0%

The Xen Project reports:

The handler for XEN_DOMCTL_gettscinfo failed to initialize a
padding field subsequently copied to guest memory.
A similar leak existed in XEN_SYSCTL_getdomaininfolist, which is
being addressed here regardless of that operation being declared
unsafe for disaggregation by XSA-77.
Malicious or buggy stub domain kernels or tool stacks otherwise
living outside of Domain0 may be able to read sensitive data
relating to the hypervisor or other guests not under the control of
that domain.

OSVersionArchitecturePackageVersionFilename
FreeBSDanynoarchxen-kernel= 4.0UNKNOWN
FreeBSDanynoarchxen-kernel< 4.5.0_3UNKNOWN

2.9 Low

CVSS2

Access Vector

ADJACENT_NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:A/AC:M/Au:N/C:P/I:N/A:N

0.001 Low

EPSS

Percentile

50.0%