CVE-2014-2915 — Improper Access Control for Register Interface in XEN

CWE-264CWE-1262 — Improper Access Control for Register Interface9 documents7 sources
Severity
5.5MEDIUMNVD
EPSS
0.1%
top 69.33%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
XENDebian XEN
Timeline
PublishedApr 24
Latest updateMay 14

Description

Xen 4.4.x, when running on ARM systems, does not properly restrict access to hardware features, which allows local guest users to cause a denial of service (host or guest crash) via unspecified vectors, related to (1) cache control, (2) coprocessors, (3) debug registers, and (4) other unspecified registers.

CVSS vector

AV:A/AC:L/C:N/I:N/A:CExploitability: 5.1 | Impact: 6.9

Affected Packages3 packages

▶Ubuntuxen/xen< 4.4.0-0ubuntu5.1
▶NVDxen/xen4.4.0
▶debiandebian/xen

🔴Vulnerability Details

2
GHSA
GHSA-496p-qjw4-wrwq: Xen 4↗2022-05-14
▶
OSV
CVE-2014-2915: Xen 4↗2014-04-24
▶

📋Vendor Advisories

2
Red Hat
xen: Hardware features unintentionally exposed to guests on ARM↗2014-04-22
▶
Debian
CVE-2014-2915: xen - Xen 4.4.x, when running on ARM systems, does not properly restrict access to har...↗2014
▶

📐Framework References

1
CWE
Improper Access Control for Register Interface↗
▶

💬Community

3
Bugzilla
CVE-2014-0471 dpkg: path traversal when unpacking a source package↗2014-04-29
▶
Bugzilla
CVE-2014-2915 xen: Hardware features unintentionally exposed to guests on ARM [fedora-all]↗2014-04-23
▶
Bugzilla
CVE-2014-2915 xen: Hardware features unintentionally exposed to guests on ARM↗2014-04-23
▶