CVE-2014-1896: Input Validation
Published Apr 1, 2014
·Updated
The (1) dosend and (2) dorecv functions in io.c in libvchan in Xen 4.2.x, 4.3.x, and 4.4-RC series allows local guests to cause a denial of service or possibly gain privileges via crafted xenstore ring indexes, which triggers a "read or write past the end of the ring."
Affected Software
7 affected components
XEN Xen=4.2.0
XEN Xen=4.2.1
XEN Xen=4.2.2
XEN Xen=4.2.3
XEN Xen=4.3.0
XEN Xen=4.3.1
XEN Xen=4.4.0-rc1
Remediation
Patch Available
Patch Available
Event History
Apr 1, 2014
CVE Published
via MITRE·01:00 AM
Data Sourced
via MITRE·01:00 AM
Description
Data Sourced
via NVD·06:35 AM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2014-1896?
CVE-2014-1896 has a moderate severity level as it can lead to denial of service and potential privilege escalation.
2
How do I fix CVE-2014-1896?
To fix CVE-2014-1896, upgrade to a patched version of Xen beyond 4.4-RC.
3
What versions of Xen are affected by CVE-2014-1896?
Xen versions 4.2.x, 4.3.x, and 4.4-RC are affected by CVE-2014-1896.
4
Can CVE-2014-1896 lead to data compromise?
While CVE-2014-1896 primarily causes denial of service, it may also allow an attacker to gain unauthorized privileges.
5
Is CVE-2014-1896 a remote or local vulnerability?
CVE-2014-1896 is a local vulnerability that affects guests within the Xen environment.