CVE-2015-6654

Name	CVE-2015-6654
Description	The xenmem_add_to_physmap_one function in arch/arm/mm.c in Xen 4.5.x, 4.4.x, and earlier does not limit the number of printk console messages when reporting a failure to retrieve a reference on a foreign page, which allows remote domains to cause a denial of service by leveraging permissions to map the memory of a foreign guest.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DSA-3414-1
Debian Bugs	800128, 823620

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
xen (PTS)	bullseye	4.14.6-1	fixed
	bullseye (security)	4.14.5+94-ge49571868d-1	fixed
	bookworm	4.17.3+10-g091466ba55-1~deb12u1	fixed
	trixie, sid	4.17.3+36-g54dacb5c02-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
xen	source	squeeze	(not affected)
xen	source	wheezy	(not affected)
xen	source	jessie	4.4.1-9+deb8u3	DSA-3414-1
xen	source	(unstable)	4.8.0~rc3-1		800128, 823620

Notes

[wheezy] - xen <not-affected> (Xen on arm not yet supported)
[squeeze] - xen <not-affected> (Xen on arm not yet supported)
http://xenbits.xen.org/xsa/advisory-141.html