CVE-2014-1895

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2014-1895
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2014-1895.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2014-1895
Published
2014-04-01T06:35:53Z
Modified
2024-11-21T02:05:13Z
Summary
[none]
Details

Off-by-one error in the flasksecurityavccachestats function in xsm/flask/flaskop.c in Xen 4.2.x and 4.3.x, when the maximum number of physical CPUs are in use, allows local users to cause a denial of service (host crash) or obtain sensitive information from hypervisor memory by leveraging a FLASKAVCCACHESTAT hypercall, which triggers a buffer over-read.

References

Affected packages

Debian:11 / xen

Package

Name
xen
Purl
pkg:deb/debian/xen?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
4.4.0-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:12 / xen

Package

Name
xen
Purl
pkg:deb/debian/xen?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
4.4.0-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:13 / xen

Package

Name
xen
Purl
pkg:deb/debian/xen?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
4.4.0-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}