PT-2014-5102 · Xen+1 · Xen+1

Chen Baozi + 1 · Publicado 2014-05-02 · Atualizado 2018-10-30 · CVE-2014-3125

Positive Technologies (AI Summary)

CVSS v2.0

6.2

Média

Vetor base

AV:A/AC:L/Au:S/C:N/I:P/A:C

Name of the Vulnerable Software and Affected Versions Xen versions 4.4.x

Description The issue is related to the improper context switching of the CNTKCTL EL1 register when Xen is running on an ARM system. This allows local guest users to modify the hardware timers, which can cause a denial of service (crash) via unspecified vectors.

Recommendations For Xen version 4.4.x, consider applying a patch or fix that properly handles the context switching of the CNTKCTL EL1 register to prevent local guest users from modifying the hardware timers and causing a denial of service.

Correção

DoS

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

ALT-PU-2014-1616

CVE-2014-3125

Produtos afetados

Alt Linux

Xen

Referências · 14

• http://securityfocus.com/bid/67157 · Nota
• https://cve.org/CVERecord?id=CVE-2014-3125 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2014-3125 · Nota de Segurança
• https://packages.altlinux.org/ru/vuln/CVE-2014-3125 · Nota
• https://errata.altlinux.org/ALT-PU-2014-1616 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2014-3125 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2014/04/30/11 · Nota
• http://secunia.com/advisories/58347 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-3125 · Aviso do Fabricante
• http://xenbits.xen.org/xsa/advisory-91.html · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3495 · Nota de Segurança
• http://openwall.com/lists/oss-security/2014/04/30/5 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3125 · Nota de Segurança
• http://securitytracker.com/id/1030184 · Nota