CVE-2014-1895

Severity Score

5.8

*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Off-by-one error in the flask_security_avc_cachestats function in xsm/flask/flask_op.c in Xen 4.2.x and 4.3.x, when the maximum number of physical CPUs are in use, allows local users to cause a denial of service (host crash) or obtain sensitive information from hypervisor memory by leveraging a FLASK_AVC_CACHESTAT hypercall, which triggers a buffer over-read.

Error de superación de límite (off-by-one) en la función flask_security_avc_cachestats en xsm/flask/flask_op.c en Xen 4.2.x y 4.3.x, cuando el número máximo de CPUs físicas están en uso, permite a usuarios locales causar una denegación de servicio (caída de host) u obtener información sensible de memoria del hipervisor mediante el aprovechamiento de una hiperllamada FLASK_AVC_CACHESTAT, lo que provoca una sobrelectura de buffer.

*Credits: N/A

CVSS Scores

NISTv2 5.8

Attack Vector

Adjacent

Attack Complexity

Medium

Authentication

Single

Confidentiality

Partial

Integrity

None

Availability

Complete

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2014-02-07 CVE Reserved
2014-04-01 CVE Published
2023-03-08 EPSS Updated
2024-08-06 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-189: Numeric Errors

CAPEC

References (5)

URL	Tag	Source
http://www.openwall.com/lists/oss-security/2014/02/07/12	Mailing List
http://www.openwall.com/lists/oss-security/2014/02/10/6	Mailing List

URL	Date	SRC

URL	Date	SRC
http://xenbits.xen.org/xsa/advisory-85.html	2017-01-07

URL	Date	SRC
http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00011.html	2017-01-07
http://security.gentoo.org/glsa/glsa-201407-03.xml	2017-01-07

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Xen Search vendor "Xen"		Xen Search vendor "Xen" for product "Xen"				4.2.0 Search vendor "Xen" for product "Xen" and version "4.2.0"		-		Affected
Xen Search vendor "Xen"		Xen Search vendor "Xen" for product "Xen"				4.2.1 Search vendor "Xen" for product "Xen" and version "4.2.1"		-		Affected
Xen Search vendor "Xen"		Xen Search vendor "Xen" for product "Xen"				4.2.2 Search vendor "Xen" for product "Xen" and version "4.2.2"		-		Affected
Xen Search vendor "Xen"		Xen Search vendor "Xen" for product "Xen"				4.2.3 Search vendor "Xen" for product "Xen" and version "4.2.3"		-		Affected
Xen Search vendor "Xen"		Xen Search vendor "Xen" for product "Xen"				4.3.0 Search vendor "Xen" for product "Xen" and version "4.3.0"		-		Affected
Xen Search vendor "Xen"		Xen Search vendor "Xen" for product "Xen"				4.3.1 Search vendor "Xen" for product "Xen" and version "4.3.1"		-		Affected