CVE-2014-3968 Denial of service in n/a

Medium 5.5 Published 5 Jun 2014 Updated 6 Aug 2024

Local guest HVM administrators can crash the host system by sending a large number of crafted MSI injection requests to the Xen hypervisor.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2014-3968?

CVE-2014-3968 is a medium-severity denial of service vulnerability in Opensuse Opensuse, published on 5 Jun 2014. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

The HVMOP_inject_msi function in Xen 4.2.x, 4.3.x, and 4.4.x allows local guest HVM administrators to cause a denial of service (host crash) via a large number of crafted requests, which trigger an error messages to be logged.

Which versions are affected by CVE-2014-3968?

It affects 2 products.

Products include Opensuse Opensuse, Xen Xen.

How do I fix CVE-2014-3968?

Apply the vendor's patch.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2014-3968 being exploited?

There is no known exploitation of CVE-2014-3968 in the wild and no public exploit code.

All Opensuse Opensuse vulnerabilities

Sources

Also known as DEBIAN-CVE-2014-3968, GHSA-mjcm-fr5w-j5f8, UBUNTU-CVE-2014-3968.