CVE-2015-7814
published 2015-10-30CVE-2015-7814: Race condition in the relinquish_memory function in arch/arm/domain.c in Xen 4.6.x and earlier allows local domains with partial management control to cause a…
PriorityP416medium4.7CVSS 2.0
AVLACMAuNCNINAC
EPSS
0.28%
19.9th percentile
Race condition in the relinquish_memory function in arch/arm/domain.c in Xen 4.6.x and earlier allows local domains with partial management control to cause a denial of service (host crash) via vectors involving the destruction of a domain and using XENMEM_decrease_reservation to reduce the memory of the domain.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | xen | < xen 4.6.0-1 (bookworm) | xen 4.6.0-1 (bookworm) |
| xen | xen | <= 4.6.0 | — |
| xen | xen | >= 0 < 4.6.0-1 | 4.6.0-1 |
| xen | xen | >= 0 < 4.6.0-1 | 4.6.0-1 |
| xen | xen | >= 0 < 4.6.0-1 | 4.6.0-1 |
| xen | xen | >= 0 < 4.6.0-1 | 4.6.0-1 |
CVSS provenance
nvdv2.04.7MEDIUMAV:L/AC:M/Au:N/C:N/I:N/A:C
osv4.7MEDIUM
vendor_debian4.7MEDIUM
vendor_redhat4.7MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
xen: Race between domain destruction and memory allocation decrease on ARM
vendor_redhat·2015-10-29·CVSS 4.7
CVE-2015-7814 [MEDIUM] xen: Race between domain destruction and memory allocation decrease on ARM
xen: Race between domain destruction and memory allocation decrease on ARM
Race condition in the relinquish_memory function in arch/arm/domain.c in Xen 4.6.x and earlier allows local domains with partial management control to cause a denial of service (host crash) via vectors involving the destruction of a domain and using XENMEM_decrease_reservation to reduce the memory of the domain.
Mitigation: There is no known mitigation. Switching from disaggregated to a non-disaggregated operation does NOT mitigate these vulnerabilities. Rather, it simply recategorises the vulnerability to hostile management code, regarding it "as designed"; thus it merely reclassifies these issues as "not a bug". Users and vendors of disaggregated systems should not change their configuration.
Package: xen (Red
Debian
CVE-2015-7814: xen - Race condition in the relinquish_memory function in arch/arm/domain.c in Xen 4.6...
vendor_debian·2015·CVSS 4.7
CVE-2015-7814 [MEDIUM] CVE-2015-7814: xen - Race condition in the relinquish_memory function in arch/arm/domain.c in Xen 4.6...
Race condition in the relinquish_memory function in arch/arm/domain.c in Xen 4.6.x and earlier allows local domains with partial management control to cause a denial of service (host crash) via vectors involving the destruction of a domain and using XENMEM_decrease_reservation to reduce the memory of the domain.
Scope: local
bookworm: resolved (fixed in 4.6.0-1)
bullseye: resolved (fixed in 4.6.0-1)
forky: resolved (fixed in 4.6.0-1)
sid: resolved (fixed in 4.6.0-1)
trixie: resolved (fixed in 4.6.0-1)
GHSA
GHSA-99f8-q7r8-wg7x: Race condition in the relinquish_memory function in arch/arm/domain
ghsa_unreviewed·2022-05-17
CVE-2015-7814 [MEDIUM] CWE-119 GHSA-99f8-q7r8-wg7x: Race condition in the relinquish_memory function in arch/arm/domain
Race condition in the relinquish_memory function in arch/arm/domain.c in Xen 4.6.x and earlier allows local domains with partial management control to cause a denial of service (host crash) via vectors involving the destruction of a domain and using XENMEM_decrease_reservation to reduce the memory of the domain.
OSV
CVE-2015-7814: Race condition in the relinquish_memory function in arch/arm/domain
osv·2015-10-30·CVSS 4.7
CVE-2015-7814 [MEDIUM] CVE-2015-7814: Race condition in the relinquish_memory function in arch/arm/domain
Race condition in the relinquish_memory function in arch/arm/domain.c in Xen 4.6.x and earlier allows local domains with partial management control to cause a denial of service (host crash) via vectors involving the destruction of a domain and using XENMEM_decrease_reservation to reduce the memory of the domain.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2015-7969 CVE-2015-7970 CVE-2015-7813 CVE-2015-7814 CVE-2015-7812 CVE-2015-7971 CVE-2015-7835 CVE-2015-7972 xen: various flaws [fedora-all]
bugzilla·2015-10-29·CVSS 4.9
CVE-2015-7969 [MEDIUM] CVE-2015-7969 CVE-2015-7970 CVE-2015-7813 CVE-2015-7814 CVE-2015-7812 CVE-2015-7971 CVE-2015-7835 CVE-2015-7972 xen: various flaws [fedora-all]
CVE-2015-7969 CVE-2015-7970 CVE-2015-7813 CVE-2015-7814 CVE-2015-7812 CVE-2015-7971 CVE-2015-7835 CVE-2015-7972 xen: various flaws [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit
Bugzilla
CVE-2015-7814 xen: Race between domain destruction and memory allocation decrease on ARM
bugzilla·2015-10-14·CVSS 4.7
CVE-2015-7814 [MEDIUM] CVE-2015-7814 xen: Race between domain destruction and memory allocation decrease on ARM
CVE-2015-7814 xen: Race between domain destruction and memory allocation decrease on ARM
While freeing the memory associated with a domain during domain destruction Xen could race with a toolstack domain reducing the amount of memory associated with that same domain via the XENMEM_decrease_reservation. In the case where this race is hit, the host will crash. The race is not exposed via the XENMEM_remove_from_physmap or XENMEM_exchange interfaces.
Domains deliberately given partial management control may be able to deny service by crashing the host. Such a domain needs to be granted access to at least one of XENMEM_decrease_reservation or XEN_DOMCTL_destroydomain over another domain. As a result, in a system designed to enhance security by radically disaggregating the management, the secu
Bugzilla
CVE-2014-7814 CFME: REST API SQL Injection
bugzilla·2014-10-27·CVSS 6.5
CVE-2014-7814 [MEDIUM] CVE-2014-7814 CFME: REST API SQL Injection
CVE-2014-7814 CFME: REST API SQL Injection
Aaron Patterson of Red Hat reports:
If the REST API is going to support a filter, that should be converted to an
ActiveRecord where clause - where it should be safer. In general, it would be
good to understand why we offer SQL filters on the REST API because I do not
think they should be exposed.
Discussion:
Acknowledgement:
This issue was discovered by the Red Hat CloudForms Team.
---
This issue has been addressed in the following products:
CloudForms Management Engine 5.3
Via RHSA-2015:0028 https://rhn.redhat.com/errata/RHSA-2015-0028.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171082.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2015-November/171185.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2015-November/171249.htmlhttp://www.debian.org/security/2015/dsa-3414http://www.securitytracker.com/id/1034030http://xenbits.xen.org/xsa/advisory-147.htmlhttps://security.gentoo.org/glsa/201604-03http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171082.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2015-November/171185.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2015-November/171249.htmlhttp://www.debian.org/security/2015/dsa-3414http://www.securitytracker.com/id/1034030http://xenbits.xen.org/xsa/advisory-147.htmlhttps://security.gentoo.org/glsa/201604-03
2015-10-30
Published