CVE-2014-1666

Published: Jan 26, 2014Modified: Apr 29, 2026

8.3

Vector

AV:A/AC:L/Au:N/C:C/I:C/A:C

Exploitability: 6.5 / Impact: 10.0

Source: NVD

Description

The do_physdev_op function in Xen 4.1.5, 4.1.6.1, 4.2.2 through 4.2.3, and 4.3.x does not properly restrict access to the (1) PHYSDEVOP_prepare_msix and (2) PHYSDEVOP_release_msix operations, which allows local PV guests to cause a denial of service (host or guest malfunction) or possibly gain privileges via unspecified vectors.

Affected (6)

Products: Xen: Xen

1 product

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Xen Xen	Version 4.1.5
Xen Xen	Version 4.1.6.1
Xen Xen	Version 4.2.2
Xen Xen	Version 4.2.3
Xen Xen	Version 4.3.0
Xen Xen	Version 4.3.1

Related CWEs

References (28)

http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127580.html

Source: cve@mitre.org

http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127607.html

Source: cve@mitre.org

http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00010.html

Source: cve@mitre.org

http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00011.html

Source: cve@mitre.org

http://osvdb.org/102536

Source: cve@mitre.org

http://secunia.com/advisories/56650

Source: cve@mitre.org

Vendor Advisory

http://security.gentoo.org/glsa/glsa-201407-03.xml

Source: cve@mitre.org

http://support.citrix.com/article/CTX200288

Source: cve@mitre.org

http://www.openwall.com/lists/oss-security/2014/01/24/6

Source: cve@mitre.org

http://www.securityfocus.com/bid/65125

Source: cve@mitre.org

http://www.securitytracker.com/id/1029684

Source: cve@mitre.org

http://xenbits.xen.org/xsa/advisory-87.html

Source: cve@mitre.org

http://xenbits.xen.org/xsa/xsa87-unstable-4.3.patch

Source: cve@mitre.org

PatchVendor Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/90675

Source: cve@mitre.org

http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127580.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127607.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00010.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00011.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://osvdb.org/102536

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/56650

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://security.gentoo.org/glsa/glsa-201407-03.xml

Source: af854a3a-2127-422b-91ae-364da2661108

http://support.citrix.com/article/CTX200288

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.openwall.com/lists/oss-security/2014/01/24/6

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/65125

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securitytracker.com/id/1029684

Source: af854a3a-2127-422b-91ae-364da2661108

http://xenbits.xen.org/xsa/advisory-87.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://xenbits.xen.org/xsa/xsa87-unstable-4.3.patch

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/90675

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.