CVE-2014-9030 — Improper Input Validation in XEN

CWE-20 — Improper Input ValidationCWE-772 — Missing Release of Resource after Effective Lifetime7 documents6 sources
Severity
7.1HIGHNVD
EPSS
1.8%
top 17.38%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
XENDebian XENDebian Linux+1 more
Timeline
PublishedNov 24
Latest updateMay 14

Description

The do_mmu_update function in arch/x86/mm.c in Xen 3.2.x through 4.4.x does not properly manage page references, which allows remote domains to cause a denial of service by leveraging control over an HVM guest and a crafted MMU_MACHPHYS_UPDATE.

CVSS vector

AV:N/AC:M/C:N/I:N/A:CExploitability: 8.6 | Impact: 6.9

Affected Packages4 packages

▶debiandebian/xen< xen 4.4.1-4 (bookworm)
▶Debianxen/xen< 4.4.1-4+3
▶NVDxen/xen32 versions+31
▶NVDopensuse/opensuse13.1, 13.2+1

Also affects: Debian Linux 7.0

Patches

Patch: xenbits.xen.org ↗Patch: xenbits.xen.org ↗

🔴Vulnerability Details

2
GHSA
GHSA-cqc3-c3mm-mqwr: The do_mmu_update function in arch/x86/mm↗2022-05-14
▶
OSV
CVE-2014-9030: The do_mmu_update function in arch/x86/mm↗2014-11-24
▶

📋Vendor Advisories

2
Red Hat
kernel: xen: Guest effectable page reference leak in MMU_MACHPHYS_UPDATE handling↗2014-11-20
▶
Debian
CVE-2014-9030: xen - The do_mmu_update function in arch/x86/mm.c in Xen 3.2.x through 4.4.x does not ...↗2014
▶

💬Community

2
Bugzilla
CVE-2014-9030 kernel: xen: Guest effectable page reference leak in MMU_MACHPHYS_UPDATE handling↗2014-11-21
▶
Bugzilla
CVE-2014-9030 kernel: xen: Guest effectable page reference leak in MMU_MACHPHYS_UPDATE handling [fedora-all]↗2014-11-21
▶