CVE-2014-9066

EUVD-2014-8892
Xen 4.4.x and earlier, when using a large number of VCPUs, does not properly handle read and write locks, which allows local x86 guest users to cause a denial of service (write denial or NMI watchdog timeout and host crash) via a large number of read requests, a different vulnerability than CVE-2014-9065.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
4.7 UNKNOWN
LOCAL
MEDIUM
AV:L/AC:M/Au:N/C:N/I:N/A:C
Base Score
CVSS 3.x
EPSS Score
Percentile: 10%
Affected Products (NVD)
VendorProductVersion
xenxen
𝑥
≤ 4.4.1
opensuseopensuse
13.1
opensuseopensuse
13.2
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
xen
bookworm
unimportant
bullseye
unimportant
bullseye (security)
unimportant
sid
unimportant
trixie
unimportant
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
xen
lucid
dne
precise
not-affected
trusty
Fixed 4.4.1-0ubuntu0.14.04.4
released
utopic
Fixed 4.4.1-0ubuntu0.14.10.4
released
xen-3.3
lucid
not-affected
precise
dne
trusty
dne
utopic
dne
Common Weakness Enumeration
References
http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00005.html
http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00010.html
http://www.openwall.com/lists/oss-security/2014/12/08/4
http://www.securityfocus.com/bid/71546
http://xenbits.xen.org/xsa/advisory-114.html
https://security.gentoo.org/glsa/201504-04
http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00005.html
http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00010.html
http://www.openwall.com/lists/oss-security/2014/12/08/4
http://www.securityfocus.com/bid/71546
http://xenbits.xen.org/xsa/advisory-114.html
https://security.gentoo.org/glsa/201504-04