CVE-2014-2599: Input Validation

Published Mar 28, 2014

Updated

The HVMOPsetmemaccess HVM control operations in Xen 4.1.x for 32-bit and 4.1.x through 4.4.x for 64-bit allow local guest administrators to cause a denial of service (CPU consumption) by leveraging access to certain service domains for HVM guests and a large input.

Affected Software

22 affected components

XEN Xen=4.1.0

XEN Xen=4.1.1

XEN Xen=4.1.2

XEN Xen=4.1.3

XEN Xen=4.1.4

XEN Xen=4.1.5

XEN Xen=4.1.6.1

XEN Xen=4.2.0

XEN Xen=4.2.1

XEN Xen=4.2.2

XEN Xen=4.2.3

XEN Xen=4.3.0

XEN Xen=4.3.1

XEN Xen=4.3.2

XEN Xen=4.4.0

Remediation

Patch Available

http://xenbits.xen.org/xsa/advisory-89.html

Event History

Mar 28, 2014

CVE Published

via MITRE·03:00 PM

Data Sourced

via MITRE·03:00 PM

Description

Data Sourced

via NVD·03:55 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2014-2599?

CVE-2014-2599 is classified as a medium severity vulnerability due to its ability to cause denial of service through high CPU consumption.

How do I fix CVE-2014-2599?

To remediate CVE-2014-2599, upgrading to the latest version of Xen that addresses this vulnerability is recommended.

Which versions of Xen are affected by CVE-2014-2599?

CVE-2014-2599 affects Xen versions 4.1.x through 4.4.x for both 32-bit and 64-bit systems.

Can local guest administrators exploit CVE-2014-2599?

Yes, local guest administrators can exploit CVE-2014-2599 by sending large inputs that impact service domains, resulting in denial of service.

Is there a patch available for CVE-2014-2599?

Yes, patches have been released for the affected versions of Xen to address CVE-2014-2599.