PT-2014-4284 · Xen+1 · Xen+1

Andrew Cooper + 1 · Published 2014-01-26 · Updated 2018-01-03 · CVE-2014-1666

Positive Technologies (AI Summary)

CVSS v2.0

8.3

High

Base vector

AV:A/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Xen versions 4.1.5 through 4.1.6.1 Xen versions 4.2.2 through 4.2.3 Xen version 4.3.x

Description The issue concerns the do physdev op function, which does not properly restrict access to the PHYSDEVOP prepare msix and PHYSDEVOP release msix operations. This allows local PV guests to cause a denial of service or possibly gain privileges via unspecified vectors.

Recommendations For Xen versions 4.1.5 through 4.1.6.1, consider restricting access to the PHYSDEVOP prepare msix and PHYSDEVOP release msix operations until a patch is available. For Xen versions 4.2.2 through 4.2.3, restrict access to the PHYSDEVOP prepare msix and PHYSDEVOP release msix operations to minimize the risk of exploitation. For Xen version 4.3.x, avoid using the do physdev op function until the issue is resolved.

Fix

DoS

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2014-1666

Affected Products

Suse

Xen

References · 18

• http://security.gentoo.org/glsa/glsa-201407-03.xml · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00010.html · Vendor Advisory
• http://xenbits.xen.org/xsa/xsa87-unstable-4.3.patch · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2014-1666 · Vendor Advisory
• http://secunia.com/advisories/56650 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2014-1666 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127580.html · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127607.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-1666 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00011.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-1666 · Vendor Advisory
• http://osvdb.org/102536 · Note
• http://openwall.com/lists/oss-security/2014/01/24/6 · Note
• http://xenbits.xen.org/xsa/advisory-87.html · Note
• http://support.citrix.com/article/CTX200288 · Note