CVE-2014-5149: Medium severity opensuse vulnerability

Published Aug 22, 2014

Updated

Certain MMU virtualization operations in Xen 4.2.x through 4.4.x, when using shadow pagetables, are not preemptible, which allows local HVM guest to cause a denial of service (vcpu consumption) by invoking these operations, which process every page assigned to a guest, a different vulnerability than CVE-2014-5146.

Affected Software

9 affected components

openSUSE openSUSE=13.1

openSUSE openSUSE=13.2

XEN Xen=4.2.0

XEN Xen=4.2.1

XEN Xen=4.2.2

XEN Xen=4.2.3

XEN Xen=4.3.0

XEN Xen=4.3.1

XEN Xen=4.4.0

Remediation

Patch Available

http://xenbits.xen.org/xsa/advisory-97.html

Event History

Aug 22, 2014

CVE Published

via MITRE·02:00 PM

Data Sourced

via MITRE·02:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2014-5149?

CVE-2014-5149 has a severity rating that indicates it can lead to denial of service due to excessive vcpu consumption.

How do I fix CVE-2014-5149?

To fix CVE-2014-5149, upgrade to a patched version of Xen that addresses this vulnerability.

Which versions of Xen are affected by CVE-2014-5149?

CVE-2014-5149 affects Xen versions 4.2.x through 4.4.x when utilizing shadow pagetables.

What type of attack is possible with CVE-2014-5149?

CVE-2014-5149 allows local HVM guests to execute operations that can cause denial of service by monopolizing CPU resources.

Is CVE-2014-5149 specific to certain operating systems?

Yes, CVE-2014-5149 impacts specific distributions of OpenSUSE such as 13.1 and 13.2, along with certain versions of Xen.