CVE-2015-8553 Details

A vulnerability in Xen hypervisor allows guest operating system users to access sensitive information from uninitialized areas of the host operating system kernel memory. This issue arises because memory and I/O decoding control bits are not properly managed, enabling unauthorized access to kernel data. The vulnerability affects Xen versions 3.3 and later, as well as upstream Linux versions 3.1 and later, due to their support for PCI pass-through and backend functionality. The problem specifically arises when a guest is granted access to a non-SR-IOV virtual function PCI Express device, which can be exploited to generate unexpected Non-Maskable Interrupts (NMIs) on the host, potentially causing a crash and leading to a denial-of-service condition.

The vulnerability can be addressed by applying the patches available in the Xen Security Advisory XSA-120 version 5 and later. For Debian users, this vulnerability has been fixed in the 'buster' distribution in version 4.19.37-5+deb10u2 or earlier.