PT-2014-5102 · Xen+1 · Xen+1

Chen Baozi + 1 · Published 2014-05-02 · Updated 2018-10-30 · CVE-2014-3125

Positive Technologies (AI Summary)

CVSS v2.0

6.2

Medium

Base vector

AV:A/AC:L/Au:S/C:N/I:P/A:C

Name of the Vulnerable Software and Affected Versions Xen versions 4.4.x

Description The issue is related to the improper context switching of the CNTKCTL EL1 register when Xen is running on an ARM system. This allows local guest users to modify the hardware timers, which can cause a denial of service (crash) via unspecified vectors.

Recommendations For Xen version 4.4.x, consider applying a patch or fix that properly handles the context switching of the CNTKCTL EL1 register to prevent local guest users from modifying the hardware timers and causing a denial of service.

Fix

DoS

Weakness Enumeration

CWE-264

Related Identifiers

ALT-PU-2014-1616

CVE-2014-3125

Affected Products

Alt Linux

Xen

References · 14

• https://cve.org/CVERecord?id=CVE-2014-3125 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2014-3125 · Security Note
• https://errata.altlinux.org/ALT-PU-2014-1616 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-3125 · Vendor Advisory
• http://secunia.com/advisories/58347 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-3125 · Vendor Advisory
• http://xenbits.xen.org/xsa/advisory-91.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3495 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3125 · Security Note
• http://securityfocus.com/bid/67157 · Note
• https://packages.altlinux.org/ru/vuln/CVE-2014-3125 · Note
• http://openwall.com/lists/oss-security/2014/04/30/11 · Note
• http://openwall.com/lists/oss-security/2014/04/30/5 · Note
• http://securitytracker.com/id/1030184 · Note