PT-2014-6303 · Citrix+1 · Xen+1

Ian Campbell + 1 · Publicado 2014-09-03 · Atualizado 2017-08-29 · CVE-2014-5148

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Média

Vetor base

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Xen versions 4.4.x

Description The issue occurs when Xen 4.4.x, running on an ARM system, handles an unknown system register access from 64-bit userspace. Instead of returning to an instruction associated with faults in 64-bit userspace, it returns to an instruction of the trap handler for kernel space faults. This allows local guest users to cause a denial of service (crash) and possibly gain privileges via a crafted process.

Recommendations For Xen version 4.4.x, consider applying a patch or fix that corrects the handling of unknown system register accesses from 64-bit userspace to prevent denial of service and potential privilege escalation.

Correção

DoS

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

ALT-PU-2014-2061

CVE-2014-5148

Produtos afetados

Alt Linux

Xen

Referências · 20

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5146 · Nota de Segurança
• https://security-tracker.debian.org/tracker/CVE-2014-5148 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2014-5148 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2014-5148 · Nota de Segurança
• http://secunia.com/advisories/59934 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5147 · Nota de Segurança
• https://errata.altlinux.org/ALT-PU-2014-2061 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2014-5148 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/95233 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-5148 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5148 · Nota de Segurança
• http://xenbits.xenproject.org/xsa/advisory-103.html · Aviso do Fabricante
• https://packages.altlinux.org/ru/vuln/CVE-2014-5148 · Nota
• http://xenbits.xen.org/xsa/advisory-103.html · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4611 · Nota de Segurança