CVE-2014-8594

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The do_mmu_update function in arch/x86/mm.c in Xen 4.x through 4.4.x does not properly restrict updates to only PV page tables, which allows remote PV guests to cause a denial of service (NULL pointer dereference) by leveraging hardware emulation services for HVM guests using Hardware Assisted Paging (HAP).

Metrics

CVSS 2.0 5.4/10AV:N/AC:H/Au:N/C:N/I:N/A:C

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00005.htmlThird Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00010.htmlThird Party Advisory
http://secunia.com/advisories/62672Permissions Required
http://www.debian.org/security/2015/dsa-3140Third Party Advisory
http://www.securityfocus.com/bid/71149
http://xenbits.xen.org/xsa/advisory-109.htmlPatch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/98767
https://security.gentoo.org/glsa/201504-04
http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00005.htmlThird Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00010.htmlThird Party Advisory
http://secunia.com/advisories/62672Permissions Required
http://www.debian.org/security/2015/dsa-3140Third Party Advisory
http://www.securityfocus.com/bid/71149
http://xenbits.xen.org/xsa/advisory-109.htmlPatch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/98767
https://security.gentoo.org/glsa/201504-04

Timeline

Published: Nov 19, 2014
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-85951.9arch/x86/x86_emulate/x86_emulate.c in Xen 3.2.1 through 4.4.x does not properly check privileges, which allows local HVM guest users to gain CVE-2014-85967.5Multiple SQL injection vulnerabilities in PHP-Fusion 7.02.07 allow remote authenticated users to execute arbitrary SQL commands via the (1) CVE-2014-85976.1A reflected cross-site scripting (XSS) vulnerability in PHP-Fusion 7.02.07 allows remote attackers to inject arbitrary web script or HTML vi CVE-2014-85986.4The XML Import/Export plugin in MantisBT 1.2.x does not restrict access, which allows remote attackers to (1) upload arbitrary XML files via CVE-2014-86004.3Multiple cross-site scripting (XSS) vulnerabilities in KDE-Runtime 4.14.3 and earlier, kwebkitpart 1.3.4 and earlier, and kio-extras 5.1.1 a CVE-2014-86015.0PowerDNS Recursor before 3.6.2 does not limit delegation chaining, which allows remote attackers to cause a denial of service ("performance CVE-2014-86024.3iterator.c in NLnet Labs Unbound before 1.5.1 does not limit delegation chaining, which allows remote attackers to cause a denial of service CVE-2014-86036.5cloner.functions.php in the XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! allows remote administrators to execute arbitrary code CVE-2014-86045.0The XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! returns the MySQL password in cleartext to a text box in the configuration pane CVE-2014-86055.0The XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! stores database backup files with predictable names under the web root with ins CVE-2014-86064.0Directory traversal vulnerability in the XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! allows remote administrators to read arbit CVE-2014-86072.1The XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! provides the MySQL username and password on the command line, which allows loca