CVE-2014-7188: High severity xen xapi vulnerability

Published Oct 2, 2014

Updated

The hvmmsrreadintercept function in arch/x86/hvm/hvm.c in Xen 4.1 through 4.4.x uses an improper MSR range for x2APIC emulation, which allows local HVM guests to cause a denial of service (host crash) or read data from the hypervisor or other guests via unspecified vectors.

Affected Software

16 affected components

XEN Xen=4.1.0

XEN Xen=4.1.1

XEN Xen=4.1.2

XEN Xen=4.1.3

XEN Xen=4.1.4

XEN Xen=4.1.5

XEN Xen=4.1.6.1

XEN Xen=4.2.0

XEN Xen=4.2.1

XEN Xen=4.2.2

XEN Xen=4.2.3

XEN Xen=4.3.0

XEN Xen=4.3.1

XEN Xen=4.4.0

XEN Xen=4.4.0-rc1

XEN Xen=4.4.1

Remediation

Patch Available

http://xenbits.xen.org/xsa/advisory-108.html

Event History

Oct 2, 2014

CVE Published

via MITRE·02:00 PM

Data Sourced

via MITRE·02:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2014-7188?

CVE-2014-7188 is categorized with a moderate severity level due to its ability to cause denial of service and potential information disclosure.

How do I fix CVE-2014-7188?

To mitigate CVE-2014-7188, upgrade to Xen version 4.4.2 or later, which contains the necessary patches.

What are the impacts of CVE-2014-7188?

CVE-2014-7188 can lead to host crashes and unauthorized data access between local HVM guests.

Which versions of Xen are affected by CVE-2014-7188?

CVE-2014-7188 affects Xen versions from 4.1.0 up to and including 4.4.1.

Is my hypervisor secure if I use a vulnerable version related to CVE-2014-7188?

Using a vulnerable version of Xen related to CVE-2014-7188 exposes your hypervisor to denial of service and potential data leakage risks.