CVE-2015-4164

Xen 3.1-4.5 - Denial of Service via compat_iret Loop Misdirection

Title source: llm
STIX 2.1

Description

The compat_iret function in Xen 3.1 through 4.5 iterates the wrong way through a loop, which allows local 32-bit PV guest administrators to cause a denial of service (large loop and system hang) via a hypercall_iret call with EFLAGS.VM set.

References (12)

Core 12
Core References
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2015/dsa-3286
Vendor Advisory x_refsource_confirm
http://support.citrix.com/article/CTX201145
Third Party Advisory vendor-advisory x_refsource_gentoo
https://security.gentoo.org/glsa/201604-03
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/75149
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1032569
Vendor Advisory x_refsource_confirm
http://xenbits.xen.org/xsa/advisory-136.html

Scores

EPSS 0.0007
EPSS Percentile 22.1%

Details

CWE
CWE-399
Status published
Products (36)
xen/xen 3.1.3
xen/xen 3.1.4
xen/xen 3.2.0
xen/xen 3.2.1
xen/xen 3.2.2
xen/xen 3.2.3
xen/xen 3.3.0
xen/xen 3.3.1
xen/xen 3.3.2
xen/xen 3.4.0
... and 26 more
Published Jun 15, 2015
Tracked Since Feb 18, 2026