CVE-2014-5146: Medium severity opensuse vulnerability

Published Aug 22, 2014

Updated

Certain MMU virtualization operations in Xen 4.2.x through 4.4.x before the xsa97-hap patch, when using Hardware Assisted Paging (HAP), are not preemptible, which allows local HVM guest to cause a denial of service (vcpu consumption) by invoking these operations, which process every page assigned to a guest, a different vulnerability than CVE-2014-5149.

Affected Software

9 affected components

openSUSE openSUSE=13.1

openSUSE openSUSE=13.2

XEN Xen=4.2.0

XEN Xen=4.2.1

XEN Xen=4.2.2

XEN Xen=4.2.3

XEN Xen=4.3.0

XEN Xen=4.3.1

XEN Xen=4.4.0

Remediation

Patch Available

http://xenbits.xen.org/xsa/advisory-97.html

Event History

Aug 22, 2014

CVE Published

via MITRE·02:00 PM

Data Sourced

via MITRE·02:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2014-5146?

CVE-2014-5146 is classified as a denial of service vulnerability affecting certain virtualization operations in Xen.

How do I fix CVE-2014-5146?

To mitigate CVE-2014-5146, upgrade to the latest version of Xen that includes the xsa97-hap patch.

Which versions of Xen are affected by CVE-2014-5146?

CVE-2014-5146 affects Xen versions 4.2.x through 4.4.x prior to the xsa97-hap patch.

How does CVE-2014-5146 impact system stability?

CVE-2014-5146 can lead to high virtual CPU consumption which may cause denial of service for local HVM guests.

Is CVE-2014-5146 specific to any operating systems?

Yes, CVE-2014-5146 affects systems running openSUSE versions 13.1 and 13.2, as well as multiple versions of Xen.