CVE-2014-3717 — Improper Input Validation in XEN

CWE-20 — Improper Input Validation5 documents5 sources
Severity
3.3LOWNVD
EPSS
0.2%
top 60.00%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
XENDebian XEN
Timeline
PublishedMay 19
Latest updateMay 14

Description

Xen 4.4.x does not properly validate the load address for 64-bit ARM guest kernels, which allows local users to read system memory or cause a denial of service (crash) via a crafted kernel, which triggers a buffer overflow.

CVSS vector

AV:L/AC:M/C:P/I:N/A:PExploitability: 3.4 | Impact: 4.9

Affected Packages3 packages

▶Ubuntuxen/xen< 4.4.0-0ubuntu5.1
▶NVDxen/xen4.4.0
▶debiandebian/xen

Patches

Patch: xenbits.xen.org ↗Patch: xenbits.xen.org ↗

🔴Vulnerability Details

2
GHSA
GHSA-5qq2-9j69-8qqc: Xen 4↗2022-05-14
▶
OSV
CVE-2014-3717: Xen 4↗2014-05-19
▶

📋Vendor Advisories

2
Debian
CVE-2014-3717: xen - Xen 4.4.x does not properly validate the load address for 64-bit ARM guest kerne...↗2014
▶
Red Hat
CVE-2014-3717: Xen 4↗
▶