CVE-2014-4021: Buffer Overflow
Published Jun 18, 2014
·Updated
Xen 3.2.x through 4.4.x does not properly clean memory pages recovered from guests, which allows local guest OS users to obtain sensitive information via unspecified vectors.
Affected Software
24 affected components
XEN Xen=3.2.0
XEN Xen=3.2.1
XEN Xen=3.2.2
XEN Xen=3.2.3
XEN Xen=4.0.0
XEN Xen=4.0.1
XEN Xen=4.0.2
XEN Xen=4.0.3
XEN Xen=4.0.4
XEN Xen=4.1.0
XEN Xen=4.1.1
XEN Xen=4.1.2
XEN Xen=4.1.3
XEN Xen=4.1.4
XEN Xen=4.1.5
XEN Xen=4.1.6.1
XEN Xen=4.2.0
XEN Xen=4.2.1
XEN Xen=4.2.2
XEN Xen=4.2.3
XEN Xen=4.3.0
XEN Xen=4.3.1
XEN Xen=4.4.0
XEN Xen=4.4.0-rc1
Remediation
Patch Available
Event History
Jun 18, 2014
CVE Published
via MITRE·07:00 PM
Data Sourced
via MITRE·07:00 PM
Description
Frequently Asked Questions
1
What are the potential impacts of CVE-2014-4021?
CVE-2014-4021 allows local guest OS users to potentially access sensitive information from memory pages not properly cleaned.
2
What versions of Xen are affected by CVE-2014-4021?
CVE-2014-4021 affects Xen versions 3.2.0 through 4.4.0, including various sub-versions.
3
How can CVE-2014-4021 be mitigated?
Mitigation for CVE-2014-4021 involves updating to a patched version of Xen that addresses the memory page cleaning issue.
4
Is CVE-2014-4021 a remote or local vulnerability?
CVE-2014-4021 is a local vulnerability, requiring access to the guest operating system.
5
What should I do if I am using a vulnerable version as identified in CVE-2014-4021?
If using a vulnerable version, you should upgrade to a non-vulnerable version of Xen as soon as possible to secure your system.