CVE-2015-2150

What it actually does

The vulnerability allows a local guest OS user to disable memory or I/O decoding for a PCI Express device via command registers, triggering an Unsupported Request response that generates a non-maskable interrupt and crashes the host.

Why it matters to the business

Virtualized environments running affected Xen or Linux kernel versions face risk of host-wide crashes from compromised or malicious guest VMs, causing downtime across all hosted workloads; the issue has remained low-probability for nearly a decade with no widespread exploitation observed.

How an attack unfolds

An attacker with local access inside a guest VM identifies a PCI Express device, writes to its command registers to disable memory or I/O decoding, then performs a device access that elicits an Unsupported Request response from the host PCI subsystem, resulting in a non-maskable interrupt and host crash.

How to fix it

Upgrade Xen beyond version 4.5.x and the Linux kernel beyond version 3.19.1 to releases that enforce proper restrictions on guest access to PCI command registers; apply all vendor-supplied hypervisor and kernel updates.

How to confirm the fix worked

Confirm updated Xen and kernel packages are installed, then attempt PCI register manipulation from a test guest to verify that such operations are now blocked or logged without causing host instability.

Typical attack path

1. Obtain local access inside a guest virtual machine
2. Enumerate available PCI Express devices from the guest
3. Write to PCI command registers to disable memory or I/O decoding
4. Issue an access to the affected device
5. Trigger Unsupported Request response leading to NMI and host crash

How to detect it

Examine hypervisor and system logs for non-maskable interrupt events, Unsupported Request PCI errors, and unexpected guest-initiated changes to PCI command registers; correlate timestamps with guest process activity.

What your security team should do

• Apply hypervisor and kernel patches to all virtualization hosts as highest priority
• Review guest isolation policies and limit PCI device passthrough where feasible
• Monitor hypervisor logs for NMI events correlated with guest PCI activity