CVE-2015-3340 Information disclosure in n/a
Remote service domains can read sensitive memory information via specific Xen hypervisor requests, requiring a patch for Xen administrators.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2015-3340?
CVE-2015-3340 is a low-severity vulnerability in Debian Debian Linux, published on 28 Apr 2015. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Xen 4.2.x through 4.5.x does not initialize certain fields, which allows certain remote service domains to obtain sensitive information from memory via a (1) XEN_DOMCTL_gettscinfo or (2) XEN_SYSCTL_getdomaininfolist request.
Weakness: CWE-200
Which versions are affected by CVE-2015-3340?
It affects 9 products.
Products include Debian Debian Linux, Fedoraproject Fedora, Opensuse Opensuse, Suse Linux Enterprise Desktop, Suse Linux Enterprise Software Development Kit, Suse Suse Linux Enterprise Desktop and 3 more.
How do I fix CVE-2015-3340?
Apply the vendor's patch.
Is CVE-2015-3340 being exploited?
There is no known exploitation of CVE-2015-3340 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as DEBIAN-CVE-2015-3340, GHSA-32p3-vxg7-c4m2, UBUNTU-CVE-2015-3340.