PT-2014-5679 · Citrix · Xen

Julien Grall · Publicado 2014-07-09 · Atualizado 2018-10-30 · CVE-2014-4022

Positive Technologies (AI Summary)

CVSS v2.0

2.7

Baixa

Vetor base

AV:A/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Xen versions 4.4.x

Description The issue arises from the alloc domain struct function in arch/arm/domain.c, which fails to properly initialize the structure containing the grant table pages for a domain when running on an ARM platform. This allows local guest administrators to obtain sensitive information via the GNTTABOP setup table subhypercall.

Recommendations For Xen version 4.4.x, consider restricting access to the GNTTABOP setup table subhypercall until a proper fix is applied. As a temporary workaround, review and limit the privileges of local guest administrators to minimize the risk of exploitation.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2014-4022

Produtos afetados

Xen

Referências · 9

• http://securitytracker.com/id/1030471 · Nota
• http://seclists.org/oss-sec/2014/q2/708 · Nota
• http://xenbits.xen.org/xsa/advisory-101.html · Aviso do Fabricante
• http://secunia.com/advisories/59523 · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-4022 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2014-4022 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2014-4022 · Nota de Segurança
• http://securityfocus.com/bid/68184 · Nota
• https://ubuntu.com/security/CVE-2014-4022 · Aviso do Fabricante