PT-2014-6301 · Xen+2 · Xen+2

Jan Beulich · Published 2014-08-22 · Updated 2024-06-15 · CVE-2014-5146

Positive Technologies (AI Summary)

CVSS v2.0

4.7

Medium

Base vector

AV:L/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Xen versions 4.2.x through 4.4.x

Description The issue affects certain MMU virtualization operations in Xen when using Hardware Assisted Paging (HAP). These operations are not preemptible, allowing a local HVM guest to cause a denial of service by consuming vcpu resources. This can be achieved by invoking these operations, which process every page assigned to a guest.

Recommendations For Xen versions 4.2.x through 4.4.x, apply the xsa97-hap patch to resolve the issue.

Fix

DoS

Weakness Enumeration

CWE-399

Related Identifiers

ALT-PU-2014-2061

CVE-2014-5146

OPENSUSE-SU-2015_0226-1

OPENSUSE-SU-2015_0256-1

OPENSUSE-SU-2024:10196-1

Affected Products

Alt Linux

Suse

Xen

References · 177

• https://osv.dev/vulnerability/openSUSE-SU-2024:10196-1 · Vendor Advisory
• https://security.gentoo.org/glsa/201504-04 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00010.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4611 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5146 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2014-5146 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00005.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5147 · Security Note
• https://errata.altlinux.org/ALT-PU-2014-2061 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136980.html · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136981.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5148 · Security Note
• http://xenbits.xen.org/xsa/advisory-97.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-5146 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-5146 · Security Note