CVE-2014-3124: Medium severity XEN Xen vulnerability

Published May 7, 2014

Updated

The HVMOPsetmemtype control in Xen 4.1 through 4.4.x allows local guest HVM administrators to cause a denial of service (hypervisor crash) or possibly execute arbitrary code by leveraging a separate qemu-dm vulnerability to trigger invalid page table translations for unspecified memory page types.

Affected Software

15 affected components

XEN Xen=4.1.0

XEN Xen=4.1.1

XEN Xen=4.1.2

XEN Xen=4.1.3

XEN Xen=4.1.4

XEN Xen=4.1.5

XEN Xen=4.1.6.1

XEN Xen=4.2.0

XEN Xen=4.2.1

XEN Xen=4.2.2

XEN Xen=4.2.3

XEN Xen=4.3.0

XEN Xen=4.3.1

XEN Xen=4.4.0

XEN Xen=4.4.0-rc1

Remediation

Patch Available

http://xenbits.xen.org/xsa/advisory-92.html

Event History

May 7, 2014

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Data Sourced

via NVD·10:55 AM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2014-3124?

CVE-2014-3124 has a high severity rating due to its potential to cause a denial of service and possible arbitrary code execution.

How do I fix CVE-2014-3124?

Fixing CVE-2014-3124 involves upgrading Xen to a patched version that addresses this vulnerability.

Which versions of Xen are affected by CVE-2014-3124?

CVE-2014-3124 affects Xen versions 4.1.0 through 4.4.0.

What type of attack does CVE-2014-3124 enable?

CVE-2014-3124 allows attackers to execute a denial of service attack or potentially execute arbitrary code via invalid page table translations.

Who is affected by CVE-2014-3124?

Local guest HVM administrators leveraging the vulnerability can impact the hypervisor, causing service disruptions.