CVE-2015-8339

CVE-2015-8339 is a medium-severity vulnerability in Xen with a CVSS 2.0 base score of 4.7. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-19.

Key facts

• Severity: Medium (CVSS 2.0 base score 4.7)
• EPSS exploit prediction: 0% (30th percentile)
• Actively exploited: Not listed in CISA KEV
• Weakness: CWE-19
• Affected product: Xen
• Published: 2015-12-17
• Last modified: 2026-06-17

Description

The memory_exchange function in common/memory.c in Xen 3.2.x through 4.6.x does not properly hand back pages to a domain, which might allow guest OS administrators to cause a denial of service (host crash) via unspecified vectors related to domain teardown.

Frequently asked questions

What is CVE-2015-8339?

The memory_exchange function in common/memory.c in Xen 3.2.x through 4.6.x does not properly hand back pages to a domain, which might allow guest OS administrators to cause a denial of service (host crash) via unspecified vectors related to domain teardown.

How severe is CVE-2015-8339?

CVE-2015-8339 has a CVSS 2.0 base score of 4.7, rated medium severity.

Is CVE-2015-8339 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (30th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2015-8339?

CVE-2015-8339 primarily affects Xen. In total, 44 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2015-8339?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2015-8339 published?

CVE-2015-8339 was published on 2015-12-17 and last updated on 2026-06-17.

References

• http://support.citrix.com/article/CTX203451
• http://www.debian.org/security/2016/dsa-3519
• http://www.securityfocus.com/bid/79038
• http://www.securitytracker.com/id/1034391
• http://xenbits.xen.org/xsa/advisory-159.html
• https://security.gentoo.org/glsa/201604-03

Affected products (44)

• cpe:2.3:o:xen:xen:3.2.0:*:*:*:*:*:*:*
• cpe:2.3:o:xen:xen:3.2.1:*:*:*:*:*:*:*
• cpe:2.3:o:xen:xen:3.2.2:*:*:*:*:*:*:*
• cpe:2.3:o:xen:xen:3.2.3:*:*:*:*:*:*:*
• cpe:2.3:o:xen:xen:3.3.0:*:*:*:*:*:*:*
• cpe:2.3:o:xen:xen:3.3.1:*:*:*:*:*:*:*
• cpe:2.3:o:xen:xen:3.3.2:*:*:*:*:*:*:*
• cpe:2.3:o:xen:xen:3.4.0:*:*:*:*:*:*:*
• cpe:2.3:o:xen:xen:3.4.1:*:*:*:*:*:*:*
• cpe:2.3:o:xen:xen:3.4.2:*:*:*:*:*:*:*
• cpe:2.3:o:xen:xen:3.4.3:*:*:*:*:*:*:*
• cpe:2.3:o:xen:xen:3.4.4:*:*:*:*:*:*:*
• cpe:2.3:o:xen:xen:4.0.0:*:*:*:*:*:*:*
• cpe:2.3:o:xen:xen:4.0.1:*:*:*:*:*:*:*
• cpe:2.3:o:xen:xen:4.0.2:*:*:*:*:*:*:*
• cpe:2.3:o:xen:xen:4.0.3:*:*:*:*:*:*:*
• cpe:2.3:o:xen:xen:4.0.4:*:*:*:*:*:*:*
• cpe:2.3:o:xen:xen:4.1.0:*:*:*:*:*:*:*
• cpe:2.3:o:xen:xen:4.1.1:*:*:*:*:*:*:*
• cpe:2.3:o:xen:xen:4.1.2:*:*:*:*:*:*:*
• cpe:2.3:o:xen:xen:4.1.3:*:*:*:*:*:*:*
• cpe:2.3:o:xen:xen:4.1.4:*:*:*:*:*:*:*
• cpe:2.3:o:xen:xen:4.1.5:*:*:*:*:*:*:*
• cpe:2.3:o:xen:xen:4.1.6:*:*:*:*:*:*:*
• cpe:2.3:o:xen:xen:4.1.6.1:*:*:*:*:*:*:*
• cpe:2.3:o:xen:xen:4.2.0:*:*:*:*:*:*:*
• cpe:2.3:o:xen:xen:4.2.1:*:*:*:*:*:*:*
• cpe:2.3:o:xen:xen:4.2.2:*:*:*:*:*:*:*
• cpe:2.3:o:xen:xen:4.2.3:*:*:*:*:*:*:*
• cpe:2.3:o:xen:xen:4.2.4:*:*:*:*:*:*:*
• cpe:2.3:o:xen:xen:4.2.5:*:*:*:*:*:*:*
• cpe:2.3:o:xen:xen:4.3.0:*:*:*:*:*:*:*
• cpe:2.3:o:xen:xen:4.3.1:*:*:*:*:*:*:*
• cpe:2.3:o:xen:xen:4.3.2:*:*:*:*:*:*:*
• cpe:2.3:o:xen:xen:4.3.3:*:*:*:*:*:*:*
• cpe:2.3:o:xen:xen:4.3.4:*:*:*:*:*:*:*
• cpe:2.3:o:xen:xen:4.4.0:*:*:*:*:*:*:*
• cpe:2.3:o:xen:xen:4.4.1:*:*:*:*:*:*:*
• cpe:2.3:o:xen:xen:4.4.2:*:*:*:*:*:*:*
• cpe:2.3:o:xen:xen:4.4.3:*:*:*:*:*:*:*

More vulnerabilities in Xen

• CVE-2017-10921 — Critical (CVSS 10.0): The grant-table feature in Xen through 4.8.x does not ensure sufficient type counts for a GNTMAP_device_map and…
• CVE-2017-10920 — Critical (CVSS 10.0): The grant-table feature in Xen through 4.8.x mishandles a GNTMAP_device_map and GNTMAP_host_map mapping, when followed…
• CVE-2017-10918 — Critical (CVSS 10.0): Xen through 4.8.x does not validate memory allocations during certain P2M operations, which allows guest OS users to…
• CVE-2017-10912 — Critical (CVSS 10.0): Xen through 4.8.x mishandles page transfer, which allows guest OS users to obtain privileged host OS access, aka…
• CVE-2015-8104 — Critical (CVSS 10.0): The KVM subsystem in the Linux kernel through 4.2.6, and Xen 4.3.x through 4.6.x, allows guest OS users to cause a…
• CVE-2018-12892 — Critical (CVSS 9.9): An issue was discovered in Xen 4.7 through 4.10.x. libxl fails to pass the readonly flag to qemu when setting up a SCSI…

All CVEs affecting Xen →

Other CWE-19 vulnerabilities

• CVE-2015-2373 — Critical (CVSS 10.0): The Remote Desktop Protocol (RDP) server service in Microsoft Windows 7 SP1, Windows 8, and Windows Server 2012 allows…
• CVE-2014-8822 — Critical (CVSS 10.0): IOHIDFamily in Apple OS X before 10.10.2 allows attackers to execute arbitrary code in a kernel context or cause a…
• CVE-2014-8817 — Critical (CVSS 10.0): coresymbolicationd in CoreSymbolication in Apple OS X before 10.10.2 does not verify that expected data types are…
• CVE-2014-4488 — Critical (CVSS 10.0): IOHIDFamily in Apple iOS before 8.1.3, Apple OS X before 10.10.2, and Apple TV before 7.0.3 does not properly validate…
• CVE-2014-7247 — Critical (CVSS 10.0): Unspecified vulnerability in JustSystems Ichitaro 2008 through 2011; Ichitaro Government 6, 7, 2008, 2009, and 2010;…
• CVE-1999-0226 — Critical (CVSS 10.0): Windows NT TCP/IP processes fragmented IP packets improperly, causing a denial of service.

Browse all CWE-19 vulnerabilities →