CVE-2014-7154: Race Condition

Published Oct 2, 2014

Updated

Race condition in HVMOPtrackdirtyvram in Xen 4.0.0 through 4.4.x does not ensure possession of the guarding lock for dirty video RAM tracking, which allows certain local guest domains to cause a denial of service via unspecified vectors.

Affected Software

21 affected components

Fedoraproject Fedora=19

Fedoraproject Fedora=20

Debian Debian Linux=7.0

XEN Xen=4.1.0

XEN Xen=4.1.1

XEN Xen=4.1.2

XEN Xen=4.1.3

XEN Xen=4.1.4

XEN Xen=4.1.5

XEN Xen=4.1.6.1

XEN Xen=4.2.0

XEN Xen=4.2.1

XEN Xen=4.2.2

XEN Xen=4.2.3

XEN Xen=4.3.0

XEN Xen=4.3.1

XEN Xen=4.4.0

XEN Xen=4.4.0-rc1

XEN Xen=4.4.1

openSUSE openSUSE=12.3

openSUSE openSUSE=13.1

Remediation

Patch Available

http://xenbits.xen.org/xsa/advisory-104.html

Event History

Oct 2, 2014

CVE Published

via MITRE·02:00 PM

Data Sourced

via MITRE·02:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2014-7154?

CVE-2014-7154 has a severity rating that poses a potential denial of service risk to affected versions of Xen.

How do I fix CVE-2014-7154?

To fix CVE-2014-7154, upgrade to a version of Xen that is not vulnerable, specifically versions after 4.4.x.

Which systems are affected by CVE-2014-7154?

CVE-2014-7154 affects multiple Fedora, Debian, and openSUSE versions, particularly those using Xen versions from 4.0.0 to 4.4.x.

What does CVE-2014-7154 exploit?

CVE-2014-7154 exploits a race condition in the HVMOP_track_dirty_vram functionality in Xen, allowing local guest domains to cause crashes.

Is there a workaround for CVE-2014-7154?

There are no documented workarounds for CVE-2014-7154, so upgrading to a patched version is recommended.