Xen 4.2.x through 4.5.x does not initialize certain fields, which allows certain remote service domains to obtain sensitive information from memory via a (1) XEN_DOMCTL_gettscinfo or (2) XEN_SYSCTL_getdomaininfolist request.
CVSS Details
- CVSS 3.1 Base Score: 7.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade xen | Dec 14, 2015 | Apr 28, 2015 |
| Freebsd | — | Upgrade xen-kernel | Dec 10, 2025 | Jul 11, 2015 |
| Gentoo Linux | — | Upgrade app-emulation/xen-tools.Upgrade app-emulation/pvgrub.Upgrade app-emulation/xen-pvgrub.Upgrade app-emulation/xen. | Oct 30, 2017 | Apr 28, 2015 |
| Suse | — | Upgrade xen-tools-xendomains-wait-diskUpgrade xen-kmp-defaultUpgrade xen-tools-domUUpgrade xen-doc-htmlUpgrade xen-libsUpgrade xen-doc-pdfUpgrade xen-libs-32bitUpgrade xen-kmp-paeUpgrade xenUpgrade xen-kmp-traceUpgrade xen-develUpgrade xen-tools | Dec 18, 2015 | Apr 28, 2015 |
| Ubuntu | — | Upgrade xen | Nov 19, 2024 | Apr 28, 2015 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub