CVE-2014-7188

Published: Oct 2, 2014Modified: May 6, 2026

8.3

Vector

AV:A/AC:L/Au:N/C:C/I:C/A:C

Exploitability: 6.5 / Impact: 10.0

Source: NVD

Description

The hvm_msr_read_intercept function in arch/x86/hvm/hvm.c in Xen 4.1 through 4.4.x uses an improper MSR range for x2APIC emulation, which allows local HVM guests to cause a denial of service (host crash) or read data from the hypervisor or other guests via unspecified vectors.

Affected (16)

Products: Xen: Xen

1 product

Configuration A

16 vulnerable

Vulnerable Software	Affected Versions
Xen Xen	Version 4.1.0
Xen Xen	Version 4.1.1
Xen Xen	Version 4.1.2
Xen Xen	Version 4.1.3
Xen Xen	Version 4.1.4
Xen Xen	Version 4.1.5
Xen Xen	Version 4.1.6.1
Xen Xen	Version 4.2.0
Xen Xen	Version 4.2.1
Xen Xen	Version 4.2.2
Xen Xen	Version 4.2.3
Xen Xen	Version 4.3.0
Xen Xen	Version 4.3.1
Xen Xen	Version 4.4.0
Xen Xen	Version 4.4.0 rc1
Xen Xen	Version 4.4.1

Related CWEs

References (34)

http://lists.fedoraproject.org/pipermail/package-announce/2014-October/140199.html

Source: cve@mitre.org

http://lists.fedoraproject.org/pipermail/package-announce/2014-October/140418.html

Source: cve@mitre.org

http://lists.fedoraproject.org/pipermail/package-announce/2014-October/140483.html

Source: cve@mitre.org

http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00002.html

Source: cve@mitre.org

http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00003.html

Source: cve@mitre.org

http://secunia.com/advisories/61664

Source: cve@mitre.org

http://secunia.com/advisories/61858

Source: cve@mitre.org

http://secunia.com/advisories/61890

Source: cve@mitre.org

http://security.gentoo.org/glsa/glsa-201412-42.xml

Source: cve@mitre.org

http://support.citrix.com/article/CTX200218

Source: cve@mitre.org

http://support.citrix.com/article/CTX201794

Source: cve@mitre.org

http://www.c7zero.info/stuff/csw2017_ExploringYourSystemDeeper_updated.pdf

Source: cve@mitre.org

http://www.debian.org/security/2014/dsa-3041

Source: cve@mitre.org

http://www.securityfocus.com/bid/70198

Source: cve@mitre.org

http://www.securitytracker.com/id/1030936

Source: cve@mitre.org

http://xenbits.xen.org/xsa/advisory-108.html

Source: cve@mitre.org

PatchVendor Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/96785

Source: cve@mitre.org

http://lists.fedoraproject.org/pipermail/package-announce/2014-October/140199.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.fedoraproject.org/pipermail/package-announce/2014-October/140418.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.fedoraproject.org/pipermail/package-announce/2014-October/140483.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00002.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00003.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/61664

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/61858

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/61890

Source: af854a3a-2127-422b-91ae-364da2661108

http://security.gentoo.org/glsa/glsa-201412-42.xml

Source: af854a3a-2127-422b-91ae-364da2661108

http://support.citrix.com/article/CTX200218

Source: af854a3a-2127-422b-91ae-364da2661108

http://support.citrix.com/article/CTX201794

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.c7zero.info/stuff/csw2017_ExploringYourSystemDeeper_updated.pdf

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.debian.org/security/2014/dsa-3041

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/70198

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securitytracker.com/id/1030936

Source: af854a3a-2127-422b-91ae-364da2661108

http://xenbits.xen.org/xsa/advisory-108.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/96785

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.