Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
4.9

Linux KVM and Xen can crash host via alignment checks

CVE-2015-5307 · published 10 years ago
Summary

The built‑in virtual machine tools in Linux kernels up to version 4.2.6 and Xen versions 4.3 through 4.6 let a user inside a virtual machine cause the main computer to freeze or restart by generating many alignment‑check errors. This can shut down all services running on the host. Update the Linux kernel and Xen packages to the latest released versions, or apply any vendor patches, to prevent the issue.

What to do
  • Update canonical linux to version 3.13.0-68.111.
  • Update canonical linux-lts-utopic to version 3.16.0-53.72~14.04.1.
  • Update canonical linux-lts-vivid to version 3.19.0-33.38~14.04.1.
  • Update canonical linux-lts-wily to version 4.2.0-18.22~14.04.1.
  • Update canonical virtualbox to version 4.3.36-dfsg-1+deb8u1ubuntu1.14.04.1.
  • Update canonical xen to version 4.4.2-0ubuntu0.14.04.3.
  • Update canonical xen to version 4.5.1-0ubuntu2.
Affected software
Ecosystem VendorProductAffected versions
– linux linux_kernel <= 4.2.3
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
– xen xen 4.3.0
4.3.1
4.3.2
4.3.3
4.3.4
4.4.0
4.4.1
4.4.2
4.4.3
4.4.4
4.5.0
4.5.1
10 more version ranges
cpe:2.3:o:xen:xen:4.3.0:*:*:*:*:*:*:*
– oracle vm_virtualbox >= 4.0.0, <= 4.0.34
>= 4.1.0, <= 4.1.42
>= 4.2.0, <= 4.2.34
>= 4.3.0, <= 4.3.29
>= 5.0.0, <= 5.0.8
cpe:2.3:a:oracle:vm_virtualbox:*:*:*:*:*:*:*:*
– debian debian_linux 7.0
8.0
cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*
– canonical ubuntu_linux 12.04
14.04
15.10
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*
Ubuntu:14.04:LTS canonical linux < 3.13.0-68.111
Fix: upgrade to 3.13.0-68.111
Ubuntu:14.04:LTS canonical linux-lts-utopic < 3.16.0-53.72~14.04.1
Fix: upgrade to 3.16.0-53.72~14.04.1
Ubuntu:14.04:LTS canonical linux-lts-vivid < 3.19.0-33.38~14.04.1
Fix: upgrade to 3.19.0-33.38~14.04.1
Ubuntu:14.04:LTS canonical linux-lts-wily < 4.2.0-18.22~14.04.1
Fix: upgrade to 4.2.0-18.22~14.04.1
Ubuntu:14.04:LTS canonical virtualbox < 4.3.36-dfsg-1+deb8u1ubuntu1.14.04.1
Fix: upgrade to 4.3.36-dfsg-1+deb8u1ubuntu1.14.04.1
Ubuntu:14.04:LTS canonical xen < 4.4.2-0ubuntu0.14.04.3
Fix: upgrade to 4.4.2-0ubuntu0.14.04.3
Ubuntu:16.04:LTS canonical xen < 4.5.1-0ubuntu2
Fix: upgrade to 4.5.1-0ubuntu2
Original advisory text
The KVM subsystem in the Linux kernel through 4.2.6, and Xen 4.3.x through 4.6.x, allows guest OS users to cause a denial of service (host OS panic or hang) by triggering many #AC (aka Alignment Ch...
The KVM subsystem in the Linux kernel through 4.2.6, and Xen 4.3.x through 4.6.x, allows guest OS users to cause a denial of service (host OS panic or hang) by triggering many #AC (aka Alignment Check) exceptions, related to svm.c and vmx.c.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
4.9 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-399Resource Management Errors
Timeline
Published10 Nov 2015
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2015-5307 · NVD
UBUNTU-CVE-2015-5307 · OSV
Track software like this
Free during beta