CVE-2014-5147

Xen 4.4.x, when running a 64-bit kernel on an ARM system, does not properly handle traps from the guest domain that use a different address width, which allows local guest users to cause a denial of service (host crash) via a crafted 32-bit process.

CVSS v2.0 4.3 MEDIUM

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:A/AC:H/Au:S/C:N/I:N/A:C

Exploitability : 2.5 / Impact : 6.9

Access Vector ADJACENT_NETWORK

Access Complexity HIGH

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact COMPLETE

References

Link	Resource
http://www.securitytracker.com/id/1030724
http://xenbits.xen.org/xsa/advisory-102.html	Patch Vendor Advisory
http://www.securitytracker.com/id/1030724
http://xenbits.xen.org/xsa/advisory-102.html	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:xen:xen:4.4.0:::::::*
	cpe:2.3:o:xen:xen:4.4.0:rc1::::::

History

21 Nov 2024, 02:11

Type	Values Removed	Values Added
References	~~() http://www.securitytracker.com/id/1030724 -~~	() http://www.securitytracker.com/id/1030724 -
References	~~() http://xenbits.xen.org/xsa/advisory-102.html - Patch, Vendor Advisory~~	() http://xenbits.xen.org/xsa/advisory-102.html - Patch, Vendor Advisory

Information

Published : 2014-08-29 16:55

Updated : 2024-11-21 02:11

NVD link : CVE-2014-5147

Mitre link : CVE-2014-5147

CVE.ORG link : CVE-2014-5147

JSON object : View

Products Affected

xen

xen

CWE

CWE-264

Permissions, Privileges, and Access Controls

{"id": "CVE-2014-5147", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "ADJACENT_NETWORK", "vectorString": "AV:A/AC:H/Au:S/C:N/I:N/A:C", "authentication": "SINGLE", "integrityImpact": "NONE", "accessComplexity": "HIGH", "availabilityImpact": "COMPLETE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 6.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 2.5, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2014-08-29T16:55:11.780", "references": [{"url": "http://www.securitytracker.com/id/1030724", "source": "cve@mitre.org"}, {"url": "http://xenbits.xen.org/xsa/advisory-102.html", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.securitytracker.com/id/1030724", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://xenbits.xen.org/xsa/advisory-102.html", "tags": ["Patch", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-264"}]}], "descriptions": [{"lang": "en", "value": "Xen 4.4.x, when running a 64-bit kernel on an ARM system, does not properly handle traps from the guest domain that use a different address width, which allows local guest users to cause a denial of service (host crash) via a crafted 32-bit process."}, {"lang": "es", "value": "Xen 4.4.x, cuando funciona un kernel de 64 bits en un sistema ARM, no maneja debidamente las trampas del domino invitado que utiliza una anchura de direcci\u00f3n diferente, lo que permite a usuarios locales invitados causar una denegaci\u00f3n de servicio (ca\u00edda del anfitri\u00f3n) a trav\u00e9s de un proceso de 32 bits manipulado."}], "lastModified": "2024-11-21T02:11:30.297", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:xen:xen:4.4.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1044792C-D544-457C-9391-4F3B5BAB978D"}, {"criteria": "cpe:2.3:o:xen:xen:4.4.0:rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CF23B21B-594A-42E2-AF90-D5C4246B39A4"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}