PT-2014-7809 · Xen+1 · Xen+1

Andrew Cooper · Published 2014-10-02 · Updated 2024-06-15 · CVE-2014-7154

Positive Technologies (AI Summary)

CVSS v2.0

6.1

Medium

Base vector

AV:A/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Xen versions 4.0.0 through 4.4.x

Description A race condition exists in the HVMOP track dirty vram function, which does not properly ensure possession of the guarding lock for dirty video RAM tracking. This issue allows certain local guest domains to cause a denial of service via unspecified vectors.

Recommendations For Xen versions 4.0.0 through 4.4.x, consider applying a patch that fixes the race condition in the HVMOP track dirty vram function to prevent denial of service attacks.

Fix

DoS

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

CVE-2014-7154

DSA-3041-1

OPENSUSE-SU-2014_1279-1

OPENSUSE-SU-2014_1281-1

OPENSUSE-SU-2024:10196-1

SUSE-SU-2015:0940-1

Affected Products

Suse

Xen

References · 177

• https://osv.dev/vulnerability/openSUSE-SU-2024:10196-1 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2014-October/140418.html · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2014-7154 · Security Note
• https://bdu.fstec.ru/vul/2015-04319 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-7154 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2014-7154 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00002.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-7154 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2014-7154 · Vendor Advisory
• http://debian.org/security/2014/dsa-3041 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00003.html · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-7154 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-7154 · Vendor Advisory
• http://xenbits.xen.org/xsa/advisory-104.html · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2014-October/140483.html · Vendor Advisory