CVE-2014-9030: Input Validation

Published Nov 24, 2014

Updated

The dommuupdate function in arch/x86/mm.c in Xen 3.2.x through 4.4.x does not properly manage page references, which allows remote domains to cause a denial of service by leveraging control over an HVM guest and a crafted MMUMACHPHYSUPDATE.

Affected Software

35 affected components

XEN Xen=3.2.0

XEN Xen=3.2.1

XEN Xen=3.2.2

XEN Xen=3.2.3

XEN Xen=3.3.0

XEN Xen=3.3.1

XEN Xen=3.3.2

XEN Xen=3.4.0

XEN Xen=3.4.1

XEN Xen=3.4.2

XEN Xen=3.4.3

XEN Xen=3.4.4

XEN Xen=4.0.0

XEN Xen=4.0.1

XEN Xen=4.0.2

XEN Xen=4.0.3

XEN Xen=4.0.4

XEN Xen=4.1.0

XEN Xen=4.1.1

XEN Xen=4.1.2

XEN Xen=4.1.3

XEN Xen=4.1.4

XEN Xen=4.1.5

XEN Xen=4.1.6.1

XEN Xen=4.2.0

XEN Xen=4.2.1

XEN Xen=4.2.2

XEN Xen=4.2.3

XEN Xen=4.3.0

XEN Xen=4.3.1

XEN Xen=4.4.0

XEN Xen=4.4.1

Debian Debian Linux=7.0

openSUSE openSUSE=13.1

openSUSE openSUSE=13.2

Remediation

Patch Available

http://xenbits.xen.org/xsa/advisory-113.html

Event History

Nov 24, 2014

CVE Published

via MITRE·03:00 PM

Data Sourced

via MITRE·03:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2014-9030?

CVE-2014-9030 has been classified as a medium severity vulnerability that can lead to denial of service.

How do I fix CVE-2014-9030?

To fix CVE-2014-9030, it is recommended to upgrade to a patched version of Xen, specifically versions 4.4.1 or higher.

What systems are affected by CVE-2014-9030?

CVE-2014-9030 affects Xen versions from 3.2.0 through 4.4.0, including various HVM guests.

What type of attack can exploit CVE-2014-9030?

CVE-2014-9030 can be exploited by remote domains to perform a denial of service attack leveraging control over an HVM guest.

Is there a workaround for CVE-2014-9030?

There are no known workarounds for CVE-2014-9030; upgrading to a secure version is the only mitigation.