CVE-2014-8867 — XEN vulnerability

CWE-176 documents6 sources
Severity
4.9MEDIUMNVD
EPSS
0.1%
top 68.12%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
6
XENDebian XENDebian Linux+3 more
Timeline
PublishedDec 1
Latest updateMay 14

Description

The acceleration support for the "REP MOVS" instruction in Xen 4.4.x, 3.2.x, and earlier lacks properly bounds checking for memory mapped I/O (MMIO) emulated in the hypervisor, which allows local HVM guests to cause a denial of service (host crash) via unspecified vectors.

CVSS vector

AV:L/AC:L/C:N/I:N/A:CExploitability: 3.9 | Impact: 6.9

Affected Packages5 packages

▶debiandebian/xen< xen 4.4.1-5 (bookworm)
▶Debianxen/xen< 4.4.1-5+3
▶NVDxen/xen3.2.0+5
▶NVDopensuse/opensuse13.1, 13.2+1

Also affects: Debian Linux 7.0, Enterprise Linux 5.0

Patches

Patch: xenbits.xenproject.org ↗Patch: xenbits.xenproject.org ↗

🔴Vulnerability Details

2
GHSA
GHSA-jj57-646v-244j: The acceleration support for the "REP MOVS" instruction in Xen 4↗2022-05-14
▶
OSV
CVE-2014-8867: The acceleration support for the "REP MOVS" instruction in Xen 4↗2014-12-01
▶

📋Vendor Advisories

2
Red Hat
xen: Insufficient bounding of "REP MOVS" to MMIO emulated inside the hypervisor (xsa112)↗2014-11-27
▶
Debian
CVE-2014-8867: xen - The acceleration support for the "REP MOVS" instruction in Xen 4.4.x, 3.2.x, and...↗2014
▶

💬Community

1
Bugzilla
CVE-2014-8867 xen: Insufficient bounding of "REP MOVS" to MMIO emulated inside the hypervisor (xsa112)↗2014-11-14
▶