PT-2014-5467 · Xen · Xen

Thomas Leonard · Published 2014-05-19 · Updated 2018-10-30 · CVE-2014-3714

Positive Technologies (AI Summary)

CVSS v2.0

3.3

Low

Base vector

AV:L/AC:M/Au:N/C:P/I:N/A:P

Name of the Vulnerable Software and Affected Versions Xen versions 4.4.x

Description The issue concerns the ARM image loading functionality, which fails to properly validate kernel length. This allows local users to potentially read system memory or cause a denial of service by crafting a 32-bit ARM guest kernel in an image, leading to a buffer overflow.

Recommendations For Xen version 4.4.x, update to a version that includes the fix for the ARM image loading functionality to prevent buffer overflows.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2014-3714

Affected Products

Xen

References · 9

• https://cve.org/CVERecord?id=CVE-2014-3714 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2014-3714 · Security Note
• https://ubuntu.com/security/CVE-2014-3714 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-3714 · Vendor Advisory
• http://xenbits.xen.org/xsa/advisory-95.html · Vendor Advisory
• http://securitytracker.com/id/1030252 · Note
• http://openwall.com/lists/oss-security/2014/05/14/4 · Note
• http://openwall.com/lists/oss-security/2014/05/15/6 · Note
• http://openwall.com/lists/oss-security/2014/05/16/1 · Note