CVE-2015-5154

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2015-5154
Heap-based buffer overflow in the IDE subsystem in QEMU, as used in Xen 4.5.x and earlier, when the container has a CDROM drive enabled, allows local guest users to execute arbitrary code on the host via unspecified ATAPI commands.

7.2 /10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:L/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 3.9 / Impact : 10.0

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References
Link Resource
http://lists.fedoraproject.org/pipermail/package-announce/2015-August/163472.html Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-August/163658.html Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-August/163681.html Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00041.html Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00042.html Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00017.html
http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00018.html
http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00020.html
http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00022.html
http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00027.html
http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00019.html
http://rhn.redhat.com/errata/RHSA-2015-1507.html
http://rhn.redhat.com/errata/RHSA-2015-1508.html
http://rhn.redhat.com/errata/RHSA-2015-1512.html
http://support.citrix.com/article/CTX201593 Third Party Advisory
http://www.debian.org/security/2015/dsa-3348
http://www.securityfocus.com/bid/76048
http://www.securitytracker.com/id/1033074
http://xenbits.xen.org/xsa/advisory-138.html Patch Vendor Advisory
https://security.gentoo.org/glsa/201510-02 Third Party Advisory
https://security.gentoo.org/glsa/201604-03
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:xen:xen:*:*:*:*:*:*:*:*
cpe:2.3:o:xen:xen:4.5.1:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:a:suse:linux_enterprise_debuginfo:11:sp4:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise_desktop:11:sp4:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise_desktop:12:*:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise_server:11:sp4:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise_software_development_kit:11:sp4:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise_software_development_kit:12:*:*:*:*:*:*:*
cpe:2.3:o:suse:suse_linux_enterprise_server:12:*:*:*:*:*:*:*

Configuration 3 (hide)

OR cpe:2.3:o:fedoraproject:fedora:21:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:22:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:23:*:*:*:*:*:*:*

Configuration 4 (hide)

cpe:2.3:a:qemu:qemu:*:*:*:*:*:*:*:*
History

13 Feb 2023, 00:50

Type Values Removed Values Added
References
  • {'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1243563', 'name': 'https://bugzilla.redhat.com/show_bug.cgi?id=1243563', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/security/cve/CVE-2015-5154', 'name': 'https://access.redhat.com/security/cve/CVE-2015-5154', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/errata/RHSA-2015:1508', 'name': 'https://access.redhat.com/errata/RHSA-2015:1508', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/errata/RHSA-2015:1507', 'name': 'https://access.redhat.com/errata/RHSA-2015:1507', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/errata/RHSA-2015:1512', 'name': 'https://access.redhat.com/errata/RHSA-2015:1512', 'tags': [], 'refsource': 'MISC'}
Summary A heap buffer overflow flaw was found in the way QEMU's IDE subsystem handled I/O buffer access while processing certain ATAPI commands. A privileged guest user in a guest with the CDROM drive enabled could potentially use this flaw to execute arbitrary code on the host with the privileges of the host's QEMU process corresponding to the guest. Heap-based buffer overflow in the IDE subsystem in QEMU, as used in Xen 4.5.x and earlier, when the container has a CDROM drive enabled, allows local guest users to execute arbitrary code on the host via unspecified ATAPI commands.

02 Feb 2023, 15:16

Type Values Removed Values Added
Summary Heap-based buffer overflow in the IDE subsystem in QEMU, as used in Xen 4.5.x and earlier, when the container has a CDROM drive enabled, allows local guest users to execute arbitrary code on the host via unspecified ATAPI commands. A heap buffer overflow flaw was found in the way QEMU's IDE subsystem handled I/O buffer access while processing certain ATAPI commands. A privileged guest user in a guest with the CDROM drive enabled could potentially use this flaw to execute arbitrary code on the host with the privileges of the host's QEMU process corresponding to the guest.
References
  • (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=1243563 -
  • (MISC) https://access.redhat.com/security/cve/CVE-2015-5154 -
  • (MISC) https://access.redhat.com/errata/RHSA-2015:1508 -
  • (MISC) https://access.redhat.com/errata/RHSA-2015:1507 -
  • (MISC) https://access.redhat.com/errata/RHSA-2015:1512 -
Information

Published : 2015-08-12 14:59

Updated : 2023-12-10 11:46

NVD link : CVE-2015-5154

Mitre link : CVE-2015-5154

CVE.ORG link : CVE-2015-5154

JSON object : View

Products Affected

suse

  • linux_enterprise_desktop
  • linux_enterprise_software_development_kit
  • linux_enterprise_debuginfo
  • suse_linux_enterprise_server
  • linux_enterprise_server

xen

  • xen

qemu

  • qemu

fedoraproject

  • fedora
CWE
CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer