CVE-2015-4163

    Dashboard / Vulnerabilities / CVE-2015-4163

    CVE-2015-4163

    Published: 15 Jun 2015Last Modified: 16 Apr 2026

    Summary:

    Details: GNTTABOP_swap_grant_ref in Xen 4.2 through 4.5 does not check the grant table operation version, which allows local guest domains to cause a denial of service (NULL pointer dereference) via a hypercall without a GNTTABOP_setup_table or GNTTABOP_set_version.

    References: http://www.debian.org/security/2015/dsa-3286, http://xenbits.xen.org/xsa/advisory-134.html, https://security.gentoo.org/glsa/201604-03, http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00004.html, http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00007.html, http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00030.html, http://support.citrix.com/article/CTX201145, http://www.securityfocus.com/bid/75141, http://www.securitytracker.com/id/1032568, https://support.citrix.com/article/CTX206006

    Affected packages

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2015-4163 | CVE-DB