CVE-2014-8594 — Improper Input Validation in XEN

CWE-20 — Improper Input Validation7 documents6 sources
Severity
5.4MEDIUMNVD
EPSS
1.4%
top 19.41%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
XENDebian XENDebian Linux+1 more
Timeline
PublishedNov 19
Latest updateMay 14

Description

The do_mmu_update function in arch/x86/mm.c in Xen 4.x through 4.4.x does not properly restrict updates to only PV page tables, which allows remote PV guests to cause a denial of service (NULL pointer dereference) by leveraging hardware emulation services for HVM guests using Hardware Assisted Paging (HAP).

CVSS vector

AV:N/AC:H/C:N/I:N/A:CExploitability: 4.9 | Impact: 6.9

Affected Packages4 packages

▶debiandebian/xen< xen 4.4.1-4 (bookworm)
▶Debianxen/xen< 4.4.1-4+3
▶NVDxen/xen18 versions+17
▶NVDopensuse/opensuse13.1, 13.2+1

Also affects: Debian Linux 7.0

Patches

Patch: xenbits.xen.org ↗Patch: xenbits.xen.org ↗

🔴Vulnerability Details

2
GHSA
GHSA-vq4v-m97r-fvvc: The do_mmu_update function in arch/x86/mm↗2022-05-14
▶
OSV
CVE-2014-8594: The do_mmu_update function in arch/x86/mm↗2014-11-19
▶

📋Vendor Advisories

2
Red Hat
kernel: xen: Insufficient restrictions on certain MMU update hypercalls (xsa109)↗2014-11-18
▶
Debian
CVE-2014-8594: xen - The do_mmu_update function in arch/x86/mm.c in Xen 4.x through 4.4.x does not pr...↗2014
▶

💬Community

2
Bugzilla
CVE-2014-8594 kernel: xen: Insufficient restrictions on certain MMU update hypercalls (xsa109) [fedora-all]↗2014-11-18
▶
Bugzilla
CVE-2014-8594 kernel: xen: Insufficient restrictions on certain MMU update hypercalls (xsa109)↗2014-11-05
▶