CVE-2014-2599

The HVMOP_set_mem_access HVM control operations in Xen 4.1.x for 32-bit and 4.1.x through 4.4.x for 64-bit allow local guest administrators to cause a denial of service (CPU consumption) by leveraging access to certain service domains for HVM guests and a large input.

CVSS v2.0 4.9 MEDIUM

4.9^/10

CVSS v2.0 : MEDIUM

Vector : AV:L/AC:L/Au:N/C:N/I:N/A:C

Exploitability : 3.9 / Impact : 6.9

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact COMPLETE

References

Link	Resource
http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00002.html
http://security.gentoo.org/glsa/glsa-201407-03.xml
http://www.debian.org/security/2014/dsa-3006
http://www.openwall.com/lists/oss-security/2014/03/25/1
http://www.openwall.com/lists/oss-security/2014/03/25/2
http://www.securityfocus.com/bid/66407
http://www.securitytracker.com/id/1029956
http://xenbits.xen.org/xsa/advisory-89.html	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:xen:xen:4.1.0:::::::*
	cpe:2.3:o:xen:xen:4.1.0::::x86:::
	cpe:2.3:o:xen:xen:4.1.1:::::::*
	cpe:2.3:o:xen:xen:4.1.1::::x86:::
	cpe:2.3:o:xen:xen:4.1.2:::::::*
	cpe:2.3:o:xen:xen:4.1.2::::x86:::
	cpe:2.3:o:xen:xen:4.1.3:::::::*
	cpe:2.3:o:xen:xen:4.1.3::::x86:::
	cpe:2.3:o:xen:xen:4.1.4:::::::*
	cpe:2.3:o:xen:xen:4.1.4::::x86:::
	cpe:2.3:o:xen:xen:4.1.5:::::::*
	cpe:2.3:o:xen:xen:4.1.5::::x86:::
	cpe:2.3:o:xen:xen:4.1.6.1:::::::*
	cpe:2.3:o:xen:xen:4.1.6.1::::x86:::
	cpe:2.3:o:xen:xen:4.2.0:::::::*
	cpe:2.3:o:xen:xen:4.2.1:::::::*
	cpe:2.3:o:xen:xen:4.2.2:::::::*
	cpe:2.3:o:xen:xen:4.2.3:::::::*
	cpe:2.3:o:xen:xen:4.3.0:::::::*
	cpe:2.3:o:xen:xen:4.3.1:::::::*
	cpe:2.3:o:xen:xen:4.3.2:::::::*
	cpe:2.3:o:xen:xen:4.4.0:::::::*

History

No history.

Information

Published : 2014-03-28 15:55

Updated : 2024-02-04 18:35

NVD link : CVE-2014-2599

Mitre link : CVE-2014-2599

CVE.ORG link : CVE-2014-2599

JSON object : View

Products Affected

xen

xen

CWE

CWE-20

Improper Input Validation

{"id": "CVE-2014-2599", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.9, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:N/I:N/A:C", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 6.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2014-03-28T15:55:08.890", "references": [{"url": "http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00002.html", "source": "cve@mitre.org"}, {"url": "http://security.gentoo.org/glsa/glsa-201407-03.xml", "source": "cve@mitre.org"}, {"url": "http://www.debian.org/security/2014/dsa-3006", "source": "cve@mitre.org"}, {"url": "http://www.openwall.com/lists/oss-security/2014/03/25/1", "source": "cve@mitre.org"}, {"url": "http://www.openwall.com/lists/oss-security/2014/03/25/2", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/66407", "source": "cve@mitre.org"}, {"url": "http://www.securitytracker.com/id/1029956", "source": "cve@mitre.org"}, {"url": "http://xenbits.xen.org/xsa/advisory-89.html", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "The HVMOP_set_mem_access HVM control operations in Xen 4.1.x for 32-bit and 4.1.x through 4.4.x for 64-bit allow local guest administrators to cause a denial of service (CPU consumption) by leveraging access to certain service domains for HVM guests and a large input."}, {"lang": "es", "value": "Las operaciones de control de HVM HVMOP_set_mem_access en Xen 4.1.x para 32 bits y 4.1.x hasta 4.4.x para 64 bits permiten a administradores locales invitados causar una denegaci\u00f3n de servicio (consumo de CPU) mediante el aprovechamiento del acceso a ciertos dominios de servicio para invitados de HVM y una entrada grande."}], "lastModified": "2017-01-07T02:59:48.533", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:xen:xen:4.1.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0D532B60-C8DD-4A2F-9D05-E574D23EB754"}, {"criteria": "cpe:2.3:o:xen:xen:4.1.0:*:*:*:x86:*:*:*", "vulnerable": true, "matchCriteriaId": "4761313C-264F-447A-B6D4-B6F27AD3BCA3"}, {"criteria": "cpe:2.3:o:xen:xen:4.1.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5D83CA8B-8E49-45FA-8FAB-C15052474542"}, {"criteria": "cpe:2.3:o:xen:xen:4.1.1:*:*:*:x86:*:*:*", "vulnerable": true, "matchCriteriaId": "BEF9F468-EBF4-4261-B4AE-C191DC2586EC"}, {"criteria": "cpe:2.3:o:xen:xen:4.1.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "27537DF5-7E0F-463F-BA87-46E329EE07AC"}, {"criteria": "cpe:2.3:o:xen:xen:4.1.2:*:*:*:x86:*:*:*", "vulnerable": true, "matchCriteriaId": "02DEEF07-182E-4C46-B30D-66E060BEADF8"}, {"criteria": "cpe:2.3:o:xen:xen:4.1.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3EA4F978-9145-4FE6-B4F9-15207E52C40A"}, {"criteria": "cpe:2.3:o:xen:xen:4.1.3:*:*:*:x86:*:*:*", "vulnerable": true, "matchCriteriaId": "4C39C1C8-AC5D-45EE-8D1C-895EC6447D27"}, {"criteria": "cpe:2.3:o:xen:xen:4.1.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "22A995FD-9B7F-4DF0-BECF-4B086E470F1E"}, {"criteria": "cpe:2.3:o:xen:xen:4.1.4:*:*:*:x86:*:*:*", "vulnerable": true, "matchCriteriaId": "518D1C53-4941-4031-9534-29D9FE271BD7"}, {"criteria": "cpe:2.3:o:xen:xen:4.1.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "219597E2-E2D7-4647-8A7C-688B96300158"}, {"criteria": "cpe:2.3:o:xen:xen:4.1.5:*:*:*:x86:*:*:*", "vulnerable": true, "matchCriteriaId": "D47AFC30-8E82-473E-9C48-FE1D885E46D3"}, {"criteria": "cpe:2.3:o:xen:xen:4.1.6.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "65E55950-EACA-4209-B2A1-E09026FC6006"}, {"criteria": "cpe:2.3:o:xen:xen:4.1.6.1:*:*:*:x86:*:*:*", "vulnerable": true, "matchCriteriaId": "C60E4208-0AF1-45A0-93C5-F70500741828"}, {"criteria": "cpe:2.3:o:xen:xen:4.2.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8F0AF8EF-6FF6-4E22-B16E-82C9F90C6B00"}, {"criteria": "cpe:2.3:o:xen:xen:4.2.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "47640819-FC43-49ED-8A77-728C3D7255B3"}, {"criteria": "cpe:2.3:o:xen:xen:4.2.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2448537F-87AD-45C1-9FB0-7A49CA31BD76"}, {"criteria": "cpe:2.3:o:xen:xen:4.2.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E36B2265-70E1-413B-A7CF-79D39E9ADCFB"}, {"criteria": "cpe:2.3:o:xen:xen:4.3.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BF948E6A-07BE-4C7D-8A98-002E89D35F4D"}, {"criteria": "cpe:2.3:o:xen:xen:4.3.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C0E23B94-1726-4F63-84BB-8D83FAB156D7"}, {"criteria": "cpe:2.3:o:xen:xen:4.3.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C76124AB-4E3D-4BE0-AAEA-7FC05868E2FB"}, {"criteria": "cpe:2.3:o:xen:xen:4.4.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1044792C-D544-457C-9391-4F3B5BAB978D"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}