CVE-2015-2756
Fixed in a distro release EPSS <1%
QEMU, as used in Xen 3.3.x through 4.5.x, does not properly restrict access to PCI command registers, which might allow local HVM guest users to cause a denial of service (non-maskable interrupt and host crash) by disabling the (1) memory or (2) I/O decoding for a PCI Express device and then accessing the device, which triggers an Unsupported Request (UR) response.
Products: debian_linux, xen, fedoraproject fedora, canonical ubuntu_linux
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | qemu | 1:2.3+dfsg-3 |
| Debian 12 | xen | 4.2.0~rc2-1 |
| Debian 13 | qemu | 1:2.3+dfsg-3 |
| Debian 13 | xen | 4.2.0~rc2-1 |
| Debian 14 | qemu | 1:2.3+dfsg-3 |
| Debian 14 | xen | 4.2.0~rc2-1 |
| Debian 7 | xen | 4.1.6.1-1+deb7u1 |
| Debian 8 | qemu | 1:2.1+dfsg-12 |
| SUSE Linux Enterprise Desktop 12 | xen | 4.4.2_02-15.1 |
| SUSE Linux Enterprise Server 12 | xen | 4.4.2_02-15.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 | xen | 4.4.2_02-15.1 |
| SUSE Linux Enterprise Software Development Kit 12 | xen | 4.4.2_02-15.1 |
| Ubuntu 14.04 LTS | qemu | 2.0.0+dfsg-2ubuntu1.11 |
| Ubuntu 14.04 LTS | xen | 4.4.1-0ubuntu0.14.04.5 |