CVE-2014-8866 — XEN vulnerability

CWE-176 documents6 sources
Severity
4.7MEDIUMNVD
EPSS
0.1%
top 74.01%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
XENDebian XENDebian Linux+1 more
Timeline
PublishedDec 1
Latest updateMay 14

Description

The compatibility mode hypercall argument translation in Xen 3.3.x through 4.4.x, when running on a 64-bit hypervisor, allows local 32-bit HVM guests to cause a denial of service (host crash) via vectors involving altering the high halves of registers while in 64-bit mode.

CVSS vector

AV:L/AC:M/C:N/I:N/A:CExploitability: 3.4 | Impact: 6.9

Affected Packages4 packages

▶debiandebian/xen< xen 4.4.1-5 (bookworm)
▶Debianxen/xen< 4.4.1-5+3
▶NVDxen/xen27 versions+26
▶NVDopensuse/opensuse13.1, 13.2+1

Also affects: Debian Linux 7.0

Patches

Patch: xenbits.xen.org ↗Patch: xenbits.xen.org ↗

🔴Vulnerability Details

2
GHSA
GHSA-gqm4-jx6m-62vq: The compatibility mode hypercall argument translation in Xen 3↗2022-05-14
▶
OSV
CVE-2014-8866: The compatibility mode hypercall argument translation in Xen 3↗2014-12-01
▶

📋Vendor Advisories

2
Red Hat
xen: Excessive checking in compatibility mode hypercall argument translation (xsa111)↗2014-11-27
▶
Debian
CVE-2014-8866: xen - The compatibility mode hypercall argument translation in Xen 3.3.x through 4.4.x...↗2014
▶

💬Community

1
Bugzilla
CVE-2014-8866 xen: Excessive checking in compatibility mode hypercall argument translation (xsa111)↗2014-11-14
▶