CVE-2014-4022 — Sensitive Information Exposure in XEN

CWE-200 — Sensitive Information Exposure6 documents6 sources
Severity
2.7LOWNVD
EPSS
0.2%
top 62.11%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
XENDebian XEN
Timeline
PublishedJul 9
Latest updateMay 14

Description

The alloc_domain_struct function in arch/arm/domain.c in Xen 4.4.x, when running on an ARM platform, does not properly initialize the structure containing the grant table pages for a domain, which allows local guest administrators to obtain sensitive information via the GNTTABOP_setup_table subhypercall.

CVSS vector

AV:A/AC:L/C:P/I:N/A:NExploitability: 5.1 | Impact: 2.9

Affected Packages3 packages

▶Ubuntuxen/xen< 4.4.0-0ubuntu5.1
▶NVDxen/xen4.4.0
▶debiandebian/xen

🔴Vulnerability Details

2
GHSA
GHSA-pjr2-q7jr-rc5x: The alloc_domain_struct function in arch/arm/domain↗2022-05-14
▶
OSV
CVE-2014-4022: The alloc_domain_struct function in arch/arm/domain↗2014-07-09
▶

📋Vendor Advisories

2
Debian
CVE-2014-4022: xen - The alloc_domain_struct function in arch/arm/domain.c in Xen 4.4.x, when running...↗2014
▶
Red Hat
CVE-2014-4022: The alloc_domain_struct function in arch/arm/domain↗
▶

💬Community

1
Bugzilla
CVE kernel non-issue statements↗2010-05-13
▶