CVE-2014-7156 Denial of service in n/a

Low 3.3 Published 2 Oct 2014 Updated 6 Aug 2024

Local HVM guest users can crash the guest system by exploiting missing supervisor mode permission checks in the Xen hypervisor's instruction emulation.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2014-7156?

CVE-2014-7156 is a low-severity denial of service vulnerability in Xen Xen, published on 2 Oct 2014. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

The x86_emulate function in arch/x86/x86_emulate/x86_emulate.c in Xen 3.3.x through 4.4.x does not check the supervisor mode permissions for instructions that generate software interrupts, which allows local HVM guest users to cause a denial of service (guest crash) via unspecified vectors.

Weakness: CWE-264

Which versions are affected by CVE-2014-7156?

It affects 1 product.

Products include Xen Xen.

How do I fix CVE-2014-7156?

Apply the vendor's patch.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2014-7156 being exploited?

There is no known exploitation of CVE-2014-7156 in the wild and no public exploit code.

All Xen Xen vulnerabilities

Sources

Also known as DEBIAN-CVE-2014-7156, GHSA-fwm9-x5p7-wwvw, UBUNTU-CVE-2014-7156.