CVE-2015-5307

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2015-5307
The KVM subsystem in the Linux kernel through 4.2.6, and Xen 4.3.x through 4.6.x, allows guest OS users to cause a denial of service (host OS panic or hang) by triggering many #AC (aka Alignment Check) exceptions, related to svm.c and vmx.c.

4.9 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:L/AC:L/Au:N/C:N/I:N/A:C

Exploitability : 3.9 / Impact : 6.9

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact COMPLETE

References
Link Resource
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=54a20552e1eae07aa240fa370a0293e006b5faed Vendor Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172187.html Mailing List Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172300.html Mailing List Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-November/172435.html Mailing List Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00035.html Mailing List Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00005.html Mailing List Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00026.html Mailing List Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00031.html Mailing List Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00013.html Mailing List Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00038.html Mailing List Third Party Advisory
http://lists.opensuse.org/opensuse-updates/2015-12/msg00039.html Mailing List Third Party Advisory
http://lists.opensuse.org/opensuse-updates/2015-12/msg00053.html Mailing List Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2015-2636.html Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2015-2645.html Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2016-0046.html Third Party Advisory
http://support.citrix.com/article/CTX202583 Third Party Advisory
http://www.debian.org/security/2015/dsa-3396 Third Party Advisory
http://www.debian.org/security/2015/dsa-3414 Third Party Advisory
http://www.debian.org/security/2016/dsa-3454 Third Party Advisory
http://www.openwall.com/lists/oss-security/2015/11/10/6 Mailing List Third Party Advisory
http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html Patch Vendor Advisory
http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html Vendor Advisory
http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html Vendor Advisory
http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html Vendor Advisory
http://www.securityfocus.com/bid/77528 Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1034105 Third Party Advisory VDB Entry
http://www.ubuntu.com/usn/USN-2800-1 Third Party Advisory
http://www.ubuntu.com/usn/USN-2801-1 Third Party Advisory
http://www.ubuntu.com/usn/USN-2802-1 Third Party Advisory
http://www.ubuntu.com/usn/USN-2803-1 Third Party Advisory
http://www.ubuntu.com/usn/USN-2804-1 Third Party Advisory
http://www.ubuntu.com/usn/USN-2805-1 Third Party Advisory
http://www.ubuntu.com/usn/USN-2806-1 Third Party Advisory
http://www.ubuntu.com/usn/USN-2807-1 Third Party Advisory
http://xenbits.xen.org/xsa/advisory-156.html Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1277172 Issue Tracking Third Party Advisory
https://github.com/torvalds/linux/commit/54a20552e1eae07aa240fa370a0293e006b5faed Vendor Advisory
https://kb.juniper.net/JSA10783 Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:o:xen:xen:4.3.0:*:*:*:*:*:*:*
cpe:2.3:o:xen:xen:4.3.1:*:*:*:*:*:*:*
cpe:2.3:o:xen:xen:4.3.2:*:*:*:*:*:*:*
cpe:2.3:o:xen:xen:4.3.3:*:*:*:*:*:*:*
cpe:2.3:o:xen:xen:4.3.4:*:*:*:*:*:*:*
cpe:2.3:o:xen:xen:4.4.0:*:*:*:*:*:*:*
cpe:2.3:o:xen:xen:4.4.1:*:*:*:*:*:*:*
cpe:2.3:o:xen:xen:4.4.2:*:*:*:*:*:*:*
cpe:2.3:o:xen:xen:4.4.3:*:*:*:*:*:*:*
cpe:2.3:o:xen:xen:4.4.4:*:*:*:*:*:*:*
cpe:2.3:o:xen:xen:4.5.0:*:*:*:*:*:*:*
cpe:2.3:o:xen:xen:4.5.1:*:*:*:*:*:*:*
cpe:2.3:o:xen:xen:4.5.2:*:*:*:*:*:*:*
cpe:2.3:o:xen:xen:4.5.3:*:*:*:*:*:*:*
cpe:2.3:o:xen:xen:4.5.5:*:*:*:*:*:*:*
cpe:2.3:o:xen:xen:4.6.0:*:*:*:*:*:*:*
cpe:2.3:o:xen:xen:4.6.1:*:*:*:*:*:*:*
cpe:2.3:o:xen:xen:4.6.2:*:*:*:*:*:*:*
cpe:2.3:o:xen:xen:4.6.3:*:*:*:*:*:*:*
cpe:2.3:o:xen:xen:4.6.4:*:*:*:*:*:*:*
cpe:2.3:o:xen:xen:4.6.5:*:*:*:*:*:*:*
cpe:2.3:o:xen:xen:4.6.6:*:*:*:*:*:*:*

Configuration 3 (hide)

OR cpe:2.3:a:oracle:vm_virtualbox:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:vm_virtualbox:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:vm_virtualbox:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:vm_virtualbox:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:vm_virtualbox:*:*:*:*:*:*:*:*

Configuration 4 (hide)

OR cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

Configuration 5 (hide)

OR cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:15.10:*:*:*:*:*:*:*
History

12 Feb 2023, 23:15

Type Values Removed Values Added
References
  • {'url': 'https://access.redhat.com/errata/RHSA-2016:0046', 'name': 'https://access.redhat.com/errata/RHSA-2016:0046', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/errata/RHSA-2015:2636', 'name': 'https://access.redhat.com/errata/RHSA-2015:2636', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/errata/RHSA-2015:2552', 'name': 'https://access.redhat.com/errata/RHSA-2015:2552', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/errata/RHSA-2016:0024', 'name': 'https://access.redhat.com/errata/RHSA-2016:0024', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/errata/RHSA-2015:2645', 'name': 'https://access.redhat.com/errata/RHSA-2015:2645', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/errata/RHSA-2015:2587', 'name': 'https://access.redhat.com/errata/RHSA-2015:2587', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/errata/RHSA-2016:0004', 'name': 'https://access.redhat.com/errata/RHSA-2016:0004', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/security/cve/CVE-2015-5307', 'name': 'https://access.redhat.com/security/cve/CVE-2015-5307', 'tags': [], 'refsource': 'MISC'}
Summary It was found that the x86 ISA (Instruction Set Architecture) is prone to a denial of service attack inside a virtualized environment in the form of an infinite loop in the microcode due to the way (sequential) delivering of benign exceptions such as #AC (alignment check exception) is handled. A privileged user inside a guest could use this flaw to create denial of service conditions on the host kernel. The KVM subsystem in the Linux kernel through 4.2.6, and Xen 4.3.x through 4.6.x, allows guest OS users to cause a denial of service (host OS panic or hang) by triggering many #AC (aka Alignment Check) exceptions, related to svm.c and vmx.c.

02 Feb 2023, 16:17

Type Values Removed Values Added
References
  • (MISC) https://access.redhat.com/errata/RHSA-2016:0046 -
  • (MISC) https://access.redhat.com/errata/RHSA-2015:2636 -
  • (MISC) https://access.redhat.com/errata/RHSA-2015:2552 -
  • (MISC) https://access.redhat.com/errata/RHSA-2016:0024 -
  • (MISC) https://access.redhat.com/errata/RHSA-2015:2645 -
  • (MISC) https://access.redhat.com/errata/RHSA-2015:2587 -
  • (MISC) https://access.redhat.com/errata/RHSA-2016:0004 -
  • (MISC) https://access.redhat.com/security/cve/CVE-2015-5307 -
Summary The KVM subsystem in the Linux kernel through 4.2.6, and Xen 4.3.x through 4.6.x, allows guest OS users to cause a denial of service (host OS panic or hang) by triggering many #AC (aka Alignment Check) exceptions, related to svm.c and vmx.c. It was found that the x86 ISA (Instruction Set Architecture) is prone to a denial of service attack inside a virtualized environment in the form of an infinite loop in the microcode due to the way (sequential) delivering of benign exceptions such as #AC (alignment check exception) is handled. A privileged user inside a guest could use this flaw to create denial of service conditions on the host kernel.
Information

Published : 2015-11-16 11:59

Updated : 2023-12-10 11:46

NVD link : CVE-2015-5307

Mitre link : CVE-2015-5307

CVE.ORG link : CVE-2015-5307

JSON object : View

Products Affected

debian

  • debian_linux

linux

  • linux_kernel

xen

  • xen

canonical

  • ubuntu_linux

oracle

  • vm_virtualbox
CWE
CWE-399

Resource Management Errors