CVE-2016-2270 Denial of service in n/a
Local guest administrators can crash the host system by mapping MMIO pages with conflicting cachability settings, requiring a hypervisor patch.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2016-2270?
CVE-2016-2270 is a medium-severity denial of service vulnerability in Debian Debian Linux, published on 19 Feb 2016. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Xen 4.6.x and earlier allows local guest administrators to cause a denial of service (host reboot) via vectors related to multiple mappings of MMIO pages with different cachability settings.
Weakness: CWE-20
Which versions are affected by CVE-2016-2270?
It affects 4 products.
Products include Debian Debian Linux, Fedoraproject Fedora, Oracle Vm Server, Xen Xen.
How do I fix CVE-2016-2270?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2016-2270 being exploited?
There is no known exploitation of CVE-2016-2270 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as DEBIAN-CVE-2016-2270, GHSA-xrgf-45jw-vmmp, UBUNTU-CVE-2016-2270.