FKIE_CVE-2016-5242

Vulnerability from fkie_nvd - Published: 2016-06-07 14:06 - Updated: 2026-06-17 00:49
Severity
5.6 (Medium) - CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H
Summary
The p2m_teardown function in arch/arm/p2m.c in Xen 4.4.x through 4.6.x allows local guest OS users with access to the driver domain to cause a denial of service (NULL pointer dereference and host OS crash) by creating concurrent domains and holding references to them, related to VMID exhaustion.
References
cve@mitre.orghttp://www.debian.org/security/2016/dsa-3633
cve@mitre.orghttp://www.securityfocus.com/bid/91015
cve@mitre.orghttp://www.securitytracker.com/id/1036035
cve@mitre.orghttp://xenbits.xen.org/xsa/advisory-181.htmlVendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.debian.org/security/2016/dsa-3633
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/91015
af854a3a-2127-422b-91ae-364da2661108http://www.securitytracker.com/id/1036035
af854a3a-2127-422b-91ae-364da2661108http://xenbits.xen.org/xsa/advisory-181.htmlVendor Advisory
Impacted products
Vendor Product Version
xen xen 4.4.0
xen xen 4.4.0
xen xen 4.4.1
xen xen 4.4.2
xen xen 4.4.3
xen xen 4.4.4
xen xen 4.5.0
xen xen 4.5.1
xen xen 4.5.2
xen xen 4.5.3
xen xen 4.6.0
xen xen 4.6.1
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "cve@mitre.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:xen:xen:4.4.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "1044792C-D544-457C-9391-4F3B5BAB978D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:xen:xen:4.4.0:rc1:*:*:*:*:*:*",
              "matchCriteriaId": "CF23B21B-594A-42E2-AF90-D5C4246B39A4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:xen:xen:4.4.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "FBD9AD01-50B7-4951-8A73-A6CF4801A487",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:xen:xen:4.4.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "89AA8FD5-E997-4F0D-AFB6-FFBE0073BA5D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:xen:xen:4.4.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "75615D84-9CA1-456C-816D-768E37B074A4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:xen:xen:4.4.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "7AB87384-A1F8-4136-A242-441C655D9364",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:xen:xen:4.5.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "90CCECD0-C0F9-45A8-8699-64428637EBCA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:xen:xen:4.5.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "F0ED340C-6746-471E-9F2D-19D62D224B7A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:xen:xen:4.5.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "99BD7C4F-DE4C-4508-B20D-46A94B616C5B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:xen:xen:4.5.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "3374F1FB-70F9-4EBC-837B-0D42282E3E5F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:xen:xen:4.6.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "4B6F7CE9-C409-4D88-9A99-B21420633F45",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:xen:xen:4.6.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "B814C381-4991-495A-B530-7543F977B346",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The p2m_teardown function in arch/arm/p2m.c in Xen 4.4.x through 4.6.x allows local guest OS users with access to the driver domain to cause a denial of service (NULL pointer dereference and host OS crash) by creating concurrent domains and holding references to them, related to VMID exhaustion."
    },
    {
      "lang": "es",
      "value": "La funci\u00f3n p2m_teardown en arch/arm/p2m.c en Xen 4.4.x hasta la versi\u00f3n 4.6.x permite a usuarios locales invitados del SO con acceso al dominio del controlador provocar una denegaci\u00f3n de servicio (referencia a puntero NULL y ca\u00edda del SO anfitri\u00f3n) creando dominios concurrentes y manejando referencias a ellos, relacionado con el agotamiento de VMID."
    }
  ],
  "evaluatorComment": "\u003ca href=\"http://cwe.mitre.org/data/definitions/476.html\"\u003eCWE-476: NULL Pointer Dereference\u003c/a\u003e",
  "id": "CVE-2016-5242",
  "lastModified": "2026-06-17T00:49:02.243",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "LOCAL",
          "authentication": "NONE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 4.7,
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "vectorString": "AV:L/AC:M/Au:N/C:N/I:N/A:C",
          "version": "2.0"
        },
        "exploitabilityScore": 3.4,
        "impactScore": 6.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 5.6,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H",
          "version": "3.0"
        },
        "exploitabilityScore": 1.1,
        "impactScore": 4.0,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2016-06-07T14:06:17.183",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "http://www.debian.org/security/2016/dsa-3633"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/bid/91015"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securitytracker.com/id/1036035"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://xenbits.xen.org/xsa/advisory-181.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.debian.org/security/2016/dsa-3633"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/91015"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securitytracker.com/id/1036035"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://xenbits.xen.org/xsa/advisory-181.html"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.