CVE-2015-4106

Published: Jun 3, 2015Modified: May 6, 2026

4.6

Vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Exploitability: 3.9 / Impact: 6.4

Source: NVD

Description

QEMU does not properly restrict write access to the PCI config space for certain PCI pass-through devices, which might allow local x86 HVM guests to gain privileges, cause a denial of service (host crash), obtain sensitive information, or possibly have other unspecified impact via unknown vectors.

Affected (23)

Products: Qemu: Qemu · Debian: Debian Linux · Fedoraproject: Fedora · +3 more

Show all products

Qemu: Qemu · Debian: Debian Linux · Fedoraproject: Fedora · Suse: Linux Enterprise Desktop, Linux Enterprise Server, Linux Enterprise Software Development Kit · Citrix: Xenserver · Canonical: Ubuntu Linux

1 product

1 product

1 product

3 products

Linux Enterprise Desktop

Linux Enterprise Server

Linux Enterprise Software Development Kit

1 product

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Qemu Qemu	Up to 2.3.1

Configuration B

2 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 7.0
Debian Debian Linux	Version 8.0

Configuration C

3 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 20
Fedoraproject Fedora	Version 21
Fedoraproject Fedora	Version 22

Configuration D

8 vulnerable

Vulnerable Software	Affected Versions
Suse Linux Enterprise Desktop	Version 11 sp3
Suse Linux Enterprise Desktop	Version 12
Suse Linux Enterprise Server	Version 11 sp1
Suse Linux Enterprise Server	Version 11 sp2
Suse Linux Enterprise Server	Version 11 sp3
Suse Linux Enterprise Server	Version 12
Suse Linux Enterprise Software Development Kit	Version 11 sp3
Suse Linux Enterprise Software Development Kit	Version 12

Configuration E

5 vulnerable

Vulnerable Software	Affected Versions
Citrix Xenserver	Version 6.0.2
Citrix Xenserver	Version 6.0
Citrix Xenserver	Version 6.1.0
Citrix Xenserver	Version 6.2.0
Citrix Xenserver	Version 6.5

Configuration F

4 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 12.04
Canonical Ubuntu Linux	Version 14.04
Canonical Ubuntu Linux	Version 14.10
Canonical Ubuntu Linux	Version 15.04

Related CWEs

Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

References (32)

http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160154.html

Source: cve@mitre.org

Third Party Advisory

http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160171.html

Source: cve@mitre.org

Third Party Advisory

http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160685.html

Source: cve@mitre.org

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00004.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00007.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00029.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00030.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://support.citrix.com/article/CTX201145

Source: cve@mitre.org

Third Party Advisory

http://www.debian.org/security/2015/dsa-3284

Source: cve@mitre.org

Third Party Advisory

http://www.debian.org/security/2015/dsa-3286

Source: cve@mitre.org

Third Party Advisory

http://www.securityfocus.com/bid/74949

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

http://www.securitytracker.com/id/1032467

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

http://www.ubuntu.com/usn/USN-2630-1

Source: cve@mitre.org

Third Party Advisory

http://xenbits.xen.org/xsa/advisory-131.html

Source: cve@mitre.org

Third Party Advisory

https://security.gentoo.org/glsa/201604-03

Source: cve@mitre.org

Third Party Advisory

https://support.citrix.com/article/CTX206006

Source: cve@mitre.org

Third Party Advisory

http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160154.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160171.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160685.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00004.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00007.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00029.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00030.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

http://support.citrix.com/article/CTX201145

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://www.debian.org/security/2015/dsa-3284

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://www.debian.org/security/2015/dsa-3286

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://www.securityfocus.com/bid/74949

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

http://www.securitytracker.com/id/1032467

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

http://www.ubuntu.com/usn/USN-2630-1

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://xenbits.xen.org/xsa/advisory-131.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://security.gentoo.org/glsa/201604-03

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://support.citrix.com/article/CTX206006

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.