CVE-2015-3340 Xen 4.2.x through 4.5.x does not initialize certain fields, which allows certain remote service domains to obtain sensitive information from memory via a (1) XEN_DOMCTL_gettscinfo or (2) XEN_SYSCTL_ge...
LowCVSS 2.9
EPSS 0.79%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Xen 4.2.x through 4.5.x does not initialize certain fields, which allows certain remote service domains to obtain sensitive information from memory via a (1) XEN_DOMCTL_gettscinfo or (2) XEN_SYSCTL_getdomaininfolist request.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/xen(Debian:12) | < 4.6.0-1 | 4.6.0-1 |
| debian/xen(Debian:13) | < 4.6.0-1 | 4.6.0-1 |
| debian/xen(Debian:14) | < 4.6.0-1 | 4.6.0-1 |
| Xen | = 4.2.0 | No fix listed |
| Xen | = 4.2.1 | No fix listed |
| Xen | = 4.2.2 | No fix listed |
| Xen | = 4.2.3 | No fix listed |
| Xen | = 4.2.4 | No fix listed |
| Xen | = 4.2.5 | No fix listed |
| Xen | = 4.3.0 | No fix listed |
| Xen | = 4.3.1 | No fix listed |
| Xen | = 4.3.2 | No fix listed |
| Xen | = 4.3.3 | No fix listed |
| Xen | = 4.3.4 | No fix listed |
| Xen | = 4.4.0 | No fix listed |
| Xen | = 4.4.1 | No fix listed |
| Xen | = 4.4.2 | No fix listed |
| Xen | = 4.5.0 | No fix listed |
| suse linux enterprise software development kit | = 11.0-sp3 | No fix listed |
| suse linux enterprise desktop | = 11.0-sp3 | No fix listed |
| suse linux enterprise server | = 11.0-sp3 | No fix listed |
| suse linux enterprise server | = 12 | No fix listed |
| fedoraproject fedora | = 20 | No fix listed |
| fedoraproject fedora | = 21 | No fix listed |
| fedoraproject fedora | = 22 | No fix listed |
Show 5 more
| Product | Affected versions | Fixed in |
|---|---|---|
| debian linux | = 7.0 | No fix listed |
| debian linux | = 8.0 | No fix listed |
| opensuse | = 13.1 | No fix listed |
| SUSE linux enterprise desktop | = 12 | No fix listed |
| SUSE linux enterprise software development kit | = 12 | No fix listed |
References
- Debian Security Tracker CVE-2015-3340 vendor-advisory
- FEDORA-2015-6569 third-party-advisory vendor-advisory
- FEDORA-2015-6670 third-party-advisory vendor-advisory
- FEDORA-2015-6583 third-party-advisory vendor-advisory
- SUSE-SU-2015:0923 third-party-advisory vendor-advisory
- SUSE-SU-2015:0927 third-party-advisory vendor-advisory
- openSUSE-SU-2015:0983 third-party-advisory vendor-advisory
- DSA-3414 third-party-advisory vendor-advisory
- 74248 third-party-advisory vdb-entry
- 1032158 third-party-advisory vdb-entry
- xenbits.xen.org patch vendor-advisory
- GLSA-201604-03 vendor-advisory
- bugs.debian.org issue-tracking