ID CVE-2016-7154
Summary Use-after-free vulnerability in the FIFO event channel code in Xen 4.4.x allows local guest OS administrators to cause a denial of service (host crash) and possibly execute arbitrary code or obtain sensitive information via an invalid guest frame number.
References
Vulnerable Configurations
  • cpe:2.3:o:xen:xen:4.4.0:*:*:*:*:*:*:*
    cpe:2.3:o:xen:xen:4.4.0:*:*:*:*:*:*:*
  • cpe:2.3:o:xen:xen:4.4.1:*:*:*:*:*:*:*
    cpe:2.3:o:xen:xen:4.4.1:*:*:*:*:*:*:*
  • cpe:2.3:o:xen:xen:4.4.2:*:*:*:*:*:*:*
    cpe:2.3:o:xen:xen:4.4.2:*:*:*:*:*:*:*
  • cpe:2.3:o:xen:xen:4.4.3:*:*:*:*:*:*:*
    cpe:2.3:o:xen:xen:4.4.3:*:*:*:*:*:*:*
  • cpe:2.3:o:xen:xen:4.4.4:*:*:*:*:*:*:*
    cpe:2.3:o:xen:xen:4.4.4:*:*:*:*:*:*:*
CVSS
Base: 7.2 (as of 10-04-2017 - 01:59)
Impact:
Exploitability:
CWE CWE-416
CAPEC
Access
VectorComplexityAuthentication
LOCAL LOW NONE
Impact
ConfidentialityIntegrityAvailability
COMPLETE COMPLETE COMPLETE
cvss-vector via4 AV:L/AC:L/Au:N/C:C/I:C/A:C
refmap via4
bid 92863
confirm
debian DSA-3663
misc http://www.c7zero.info/stuff/csw2017_ExploringYourSystemDeeper_updated.pdf
sectrack 1036754
Last major update 10-04-2017 - 01:59
Published 21-09-2016 - 14:25
Last modified 10-04-2017 - 01:59
Back to Top