CVE-2015-8341
The libxl toolstack library in Xen 4.1.x through 4.6.x does not properly release mappings of...
The libxl toolstack library in Xen 4.1.x through 4.6.x does not properly release mappings of files used as kernels and initial ramdisks when managing multiple domains in the same process, which allows attackers to cause a denial of service (memory and disk consumption) by starting domains.
Exploit likelihood
What each source reports
NVD Score used
The libxl toolstack library in Xen 4.1.x through 4.6.x does not properly release mappings of files used as kernels and initial ramdisks when managing multiple domains in the same process, which allows attackers to cause a denial of service (memory and disk consumption) by starting domains.
- Record
CVE-2015-8341- CVSS 2.0
- 7.8 High
AV:N/AC:L/Au:N/C:N/I:N/A:C - Weakness
- CWE-399
- Updated
- 2026-11-02
CVE List No score
The libxl toolstack library in Xen 4.1.x through 4.6.x does not properly release mappings of files used as kernels and initial ramdisks when managing multiple domains in the same process, which allows attackers to cause a denial of service (memory and disk consumption) by starting domains.
- Record
CVE-2015-8341- Updated
- 2026-11-02
EUVDEUVD-2015-8225 No score
The libxl toolstack library in Xen 4.1.x through 4.6.x does not properly release mappings of files used as kernels and initial ramdisks when managing multiple domains in the same process, which allows attackers to cause a denial of service (memory and disk consumption) by starting domains.
- Record
EUVD-2015-8225- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-qcgw-prmf-2x36 No score
The libxl toolstack library in Xen 4.1.x through 4.6.x does not properly release mappings of...
The libxl toolstack library in Xen 4.1.x through 4.6.x does not properly release mappings of files used as kernels and initial ramdisks when managing multiple domains in the same process, which allows attackers to cause a denial of service (memory and disk consumption) by starting domains.
- Record
GHSA-qcgw-prmf-2x36- Updated
- 2026-11-02
OSV No score
The libxl toolstack library in Xen 4.1.x through 4.6.x does not properly release mappings of files used as kernels and initial ramdisks when managing multiple domains in the same process, which allows attackers to cause a denial of service (memory and disk consumption) by starting domains.
- Record
CVE-2015-8341- Updated
- 2026-11-02
OSVDEBIAN-CVE-2015-8341 No score
The libxl toolstack library in Xen 4.1.x through 4.6.x does not properly release mappings of files used as kernels and initial ramdisks when managing multiple domains in the same process, which allows attackers to cause a denial of service (memory and disk consumption) by starting domains.
- Record
DEBIAN-CVE-2015-8341- Updated
- 2026-11-02
Show 6 moreShow less
OSVopenSUSE-SU-2024:10196-1 No score
xen-4.7.0_12-1.3 on GA media
These are all security issues fixed in the xen-4.7.0_12-1.3 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10196-1- Updated
- 2026-11-02
OSVSUSE-SU-2015:2324-1 No score
Security update for xen
This update fixes the following security issues:
-
bsc#956832 - CVE-2015-8345: xen: qemu: net: eepro100: infinite loop in processing command block list
-
Revert x86/IO-APIC: don't create pIRQ mapping from masked RTE until kernel maintenance release goes out.
-
bsc#956592 - xen: virtual PMU is unsupported (XSA-163)
-
bsc#956408 - CVE-2015-8339, CVE-2015-8340: xen: XENMEM_exchange error handling issues (XSA-159)
-
bsc#956409 - CVE-2015-8341: xen: libxl leak of pv kernel and initrd on error (XSA-160)
-
bsc#956411 - CVE-2015-7504: xen: heap buffer overflow vulnerability in pcnet emulator (XSA-162)
-
bsc#947165 - CVE-2015-7311: xen: libxl fails to honour readonly flag on disks with qemu-xen (xsa-142)
-
bsc#954405 - CVE-2015-8104: Xen: guest to host DoS by triggering an infinite loop in microcode via #DB exception
-
bsc#954018 - CVE-2015-5307: xen: x86: CPU lockup during fault delivery (XSA-156)
- Record
SUSE-SU-2015:2324-1- Updated
- 2026-11-02
OSVSUSE-SU-2015:2326-1 No score
Security update for xen
This update fixes the following security issues:
-
bsc#956832 - CVE-2015-8345: xen: qemu: net: eepro100: infinite loop in processing command block list
-
bsc#956592 - xen: virtual PMU is unsupported (XSA-163)
-
bsc#956408 - CVE-2015-8339, CVE-2015-8340: xen: XENMEM_exchange error handling issues (XSA-159)
-
bsc#956409 - CVE-2015-8341: xen: libxl leak of pv kernel and initrd on error (XSA-160)
-
bsc#956411 - CVE-2015-7504: xen: heap buffer overflow vulnerability in pcnet emulator (XSA-162)
-
bsc#947165 - CVE-2015-7311: xen: libxl fails to honour readonly flag on disks with qemu-xen (xsa-142)
-
bsc#954405 - CVE-2015-8104: Xen: guest to host DoS by triggering an infinite loop in microcode via #DB exception
-
bsc#954018 - CVE-2015-5307: xen: x86: CPU lockup during fault delivery (XSA-156)
-
bsc#950704 - CVE-2015-7970: xen: x86: Long latency populate-on-demand operation is not preemptible (XSA-150)
-
bsc#951845 - CVE-2015-7972: xen: x86: populate-on-demand balloon size inaccuracy can crash guests (XSA-153)
-
bsc#950703 - CVE-2015-7969: xen: leak of main per-domain vcpu pointer array (DoS) (XSA-149)
-
bsc#950705 - CVE-2015-7969: xen: x86: leak of per-domain profiling-related vcpu pointer array (DoS) (XSA-151)
-
bsc#950706 - CVE-2015-7971: xen: x86: some pmu and profiling hypercalls log without rate limiting (XSA-152)
- Record
SUSE-SU-2015:2326-1- Updated
- 2026-11-02
OSVSUSE-SU-2015:2328-1 No score
Security update for xen
This update fixes the following security issues:
-
bsc#956832 - CVE-2015-8345: xen: qemu: net: eepro100: infinite loop in processing command block list
-
bsc#956592 - xen: virtual PMU is unsupported (XSA-163)
-
bsc#956408 - CVE-2015-8339, CVE-2015-8340: xen: XENMEM_exchange error handling issues (XSA-159)
-
bsc#956409 - CVE-2015-8341: xen: libxl leak of pv kernel and initrd on error (XSA-160)
-
bsc#956411 - CVE-2015-7504: xen: heap buffer overflow vulnerability in pcnet emulator (XSA-162)
-
bsc#947165 - CVE-2015-7311: xen: libxl fails to honour readonly flag on disks with qemu-xen (xsa-142)
-
bsc#954405 - CVE-2015-8104: Xen: guest to host DoS by triggering an infinite loop in microcode via #DB exception
-
bsc#954018 - CVE-2015-5307: xen: x86: CPU lockup during fault delivery (XSA-156) CVE-2015-5307-xsa156.patch
-
bsc#950704 - CVE-2015-7970: xen: x86: Long latency populate-on-demand operation is not preemptible (XSA-150) 563212c9-x86-PoD-Eager-sweep-for-zeroed-pages.patch
-
bsc#951845 - CVE-2015-7972: xen: x86: populate-on-demand balloon size inaccuracy can crash guests (XSA-153) xsa153-libxl.patch xend-xsa153.patch
-
Drop 5604f239-x86-PV-properly-populate-descriptor-tables.patch
-
bsc#950703 - CVE-2015-7969: xen: leak of main per-domain vcpu pointer array (DoS) (XSA-149)
-
bsc#950705 - CVE-2015-7969: xen: x86: leak of per-domain profiling-related vcpu pointer array (DoS) (XSA-151)
-
bsc#950706 - CVE-2015-7971: xen: x86: some pmu and profiling hypercalls log without rate limiting (XSA-152)
- Record
SUSE-SU-2015:2328-1- Updated
- 2026-11-02
OSVSUSE-SU-2015:2338-1 No score
Security update for xen
This update fixes the following security issues:
-
bsc#955399 - Fix xm migrate --log_progress. Due to logic error progress was not logged when requested.
-
bsc#956832 - CVE-2015-8345: xen: qemu: net: eepro100: infinite loop in processing command block list
-
bsc#956592 - xen: virtual PMU is unsupported (XSA-163)
-
bsc#956408 - CVE-2015-8339, CVE-2015-8340: xen: XENMEM_exchange error handling issues (XSA-159)
-
bsc#956409 - CVE-2015-8341: xen: libxl leak of pv kernel and initrd on error (XSA-160)
-
bsc#956411 - CVE-2015-7504: xen: heap buffer overflow vulnerability in pcnet emulator (XSA-162)
-
bsc#947165 - CVE-2015-7311: xen: libxl fails to honour readonly flag on disks with qemu-xen (xsa-142)
-
bsc#955399 - Fix xm migrate --live. The options were not passed due to a merge error. As a result the migration was not live, instead the suspended guest was migrated.
-
bsc#954405 - CVE-2015-8104: Xen: guest to host DoS by triggering an infinite loop in microcode via #DB exception
-
bsc#954018 - CVE-2015-5307: xen: x86: CPU lockup during fault delivery (XSA-156)
-
bsc#950704 - CVE-2015-7970: xen: x86: Long latency populate-on-demand operation is not preemptible (XSA-150)
-
bsc#951845 - CVE-2015-7972: xen: x86: populate-on-demand balloon size inaccuracy can crash guests (XSA-153)
-
Drop 5604f239-x86-PV-properly-populate-descriptor-tables.patch
-
bsc#950703 - CVE-2015-7969: xen: leak of main per-domain vcpu pointer array (DoS) (XSA-149)
-
bsc#950705 - CVE-2015-7969: xen: x86: leak of per-domain profiling-related vcpu pointer array (DoS) (XSA-151)
-
bsc#950706 - CVE-2015-7971: xen: x86: some pmu and profiling hypercalls log without rate limiting (XSA-152)
- Record
SUSE-SU-2015:2338-1- Updated
- 2026-11-02
OSVUBUNTU-CVE-2015-8341 No score
The libxl toolstack library in Xen 4.1.x through 4.6.x does not properly release mappings of files used as kernels and initial ramdisks when managing multiple domains in the same process, which allows attackers to cause a denial of service (memory and disk consumption) by starting domains.
- Record
UBUNTU-CVE-2015-8341- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
xenDebian:12 |
before 4.8.0~rc3-1 | 4.8.0~rc3-1 |
xenDebian:13 |
before 4.8.0~rc3-1 | 4.8.0~rc3-1 |
xenDebian:14 |
before 4.8.0~rc3-1 | 4.8.0~rc3-1 |
xenDebian:8 |
before 4.4.1-9+deb8u4, plus listed versions 4.4.1-94.4.1-9+deb8u14.4.1-9+deb8u24.4.1-9+deb8u3 |
4.4.1-9+deb8u4 |
xenSUSE:Linux Enterprise Desktop 12 SP1 |
before 4.5.2_02-4.1 | 4.5.2_02-4.1 |
xenSUSE:Linux Enterprise Software Development Kit 12 SP1 |
before 4.5.2_02-4.1 | 4.5.2_02-4.1 |
xenSUSE:Linux Enterprise Server 12 SP1 |
before 4.5.2_02-4.1 | 4.5.2_02-4.1 |
xenSUSE:Linux Enterprise Server for SAP Applications 12 SP1 |
before 4.5.2_02-4.1 | 4.5.2_02-4.1 |
xenSUSE:Linux Enterprise Software Development Kit 11 SP3 |
before 4.2.5_18-21.1 | 4.2.5_18-21.1 |
xenSUSE:Linux Enterprise Desktop 11 SP3 |
before 4.2.5_18-21.1 | 4.2.5_18-21.1 |
Show 13 moreShow less
| Package | Affected | Fixed |
|---|---|---|
xenSUSE:Linux Enterprise Server 11 SP3 |
before 4.2.5_18-21.1 | 4.2.5_18-21.1 |
xenSUSE:Linux Enterprise Server 11 SP3-TERADATA |
before 4.2.5_18-21.1 | 4.2.5_18-21.1 |
xenSUSE:Linux Enterprise Server for SAP Applications 11 SP3 |
before 4.2.5_18-21.1 | 4.2.5_18-21.1 |
xenSUSE:Linux Enterprise Desktop 12 |
before 4.4.3_06-22.15.1 | 4.4.3_06-22.15.1 |
xenSUSE:Linux Enterprise Software Development Kit 12 |
before 4.4.3_06-22.15.1 | 4.4.3_06-22.15.1 |
xenSUSE:Linux Enterprise Server 12 |
before 4.4.3_06-22.15.1 | 4.4.3_06-22.15.1 |
xenSUSE:Linux Enterprise Server for SAP Applications 12 |
before 4.4.3_06-22.15.1 | 4.4.3_06-22.15.1 |
xenSUSE:Linux Enterprise Software Development Kit 11 SP4 |
before 4.4.3_06-29.1 | 4.4.3_06-29.1 |
xenSUSE:Linux Enterprise Desktop 11 SP4 |
before 4.4.3_06-29.1 | 4.4.3_06-29.1 |
xenSUSE:Linux Enterprise Server 11 SP4 |
before 4.4.3_06-29.1 | 4.4.3_06-29.1 |
xenSUSE:Linux Enterprise Server for SAP Applications 11 SP4 |
before 4.4.3_06-29.1 | 4.4.3_06-29.1 |
xenUbuntu:14.04:LTS |
before 4.4.2-0ubuntu0.14.04.4, plus listed versions 4.3.0-1ubuntu14.3.0-1ubuntu24.3.0-1ubuntu34.3.0-1ubuntu44.3.0-1ubuntu5 Show 14 moreShow less4.4.0-0ubuntu34.4.0-0ubuntu44.4.0-0ubuntu54.4.0-0ubuntu5.14.4.0-0ubuntu5.24.4.1-0ubuntu0.14.04.14.4.1-0ubuntu0.14.04.24.4.1-0ubuntu0.14.04.34.4.1-0ubuntu0.14.04.44.4.1-0ubuntu0.14.04.54.4.1-0ubuntu0.14.04.64.4.2-0ubuntu0.14.04.14.4.2-0ubuntu0.14.04.24.4.2-0ubuntu0.14.04.3 |
4.4.2-0ubuntu0.14.04.4 |
xenopenSUSE:Tumbleweed |
before 4.7.0_12-1.3 | 4.7.0_12-1.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2015-8341 is a high vulnerability (CVSS 7.8) in Xen, published December 17, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.04%, the 81st percentile. Fixed in xen 4.8.0~rc3-1.
References
debian.org/security/2016/dsa-3519
xenbits.xen.org/xsa/advisory-160.html
securitytracker.com/id/1034389
security.gentoo.org/glsa/201604-03
nvd.nist.gov/vuln/detail/CVE-2015-8341
github.com/advisories/GHSA-qcgw-prmf-2x36
Show 145 moreShow less
security-tracker.debian.org/tracker/CVE-2015-8341
suse.com/support/update/announcement/2015/suse-su-20152324-1
bugzilla.suse.com/947165
ubuntu.com/security/CVE-2015-8341
cve.org/CVERecord?id=CVE-2015-8341