CVE-2014-9065

MediumCVSS 4.4/10Last modified Jun 17, 2026

Description

common/spinlock.c in Xen 4.4.x and earlier does not properly handle read and write locks, which allows local x86 guest users to cause a denial of service (write denial or NMI watchdog timeout and host crash) via a large number of read requests, a different vulnerability to CVE-2014-9066.

Metrics

CVSS 2.0 4.4/10AV:L/AC:M/Au:S/C:N/I:N/A:C

Weakness enumeration

CWE-17

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00005.htmlThird Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00010.htmlThird Party Advisory
http://www.openwall.com/lists/oss-security/2014/12/08/4Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/71544Third Party Advisory, VDB Entry
http://xenbits.xen.org/xsa/advisory-114.htmlPatch, Vendor Advisory
https://security.gentoo.org/glsa/201504-04Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00005.htmlThird Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00010.htmlThird Party Advisory
http://www.openwall.com/lists/oss-security/2014/12/08/4Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/71544Third Party Advisory, VDB Entry
http://xenbits.xen.org/xsa/advisory-114.htmlPatch, Vendor Advisory
https://security.gentoo.org/glsa/201504-04Third Party Advisory

Timeline

Published: Dec 9, 2014
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-90664.7Xen 4.4.x and earlier, when using a large number of VCPUs, does not properly handle read and write locks, which allows local x86 guest users CVE-2014-90877.5Integer underflow in the ksba_oid_to_str function in Libksba before 1.3.2, as used in GnuPG, allows remote attackers to cause a denial of se CVE-2014-90897.5Multiple SQL injection vulnerabilities in view_all_bug_page.php in MantisBT before 1.2.18 allow remote attackers to execute arbitrary SQL co CVE-2014-90904.9The do_double_fault function in arch/x86/kernel/traps.c in the Linux kernel through 3.17.4 does not properly handle faults associated with t CVE-2014-90914.6Icecast before 2.4.0 does not change the supplementary group privileges when <changeowner> is configured, which allows local users to gain p CVE-2014-90926.5libjpeg-turbo before 1.3.1 allows remote attackers to cause a denial of service (crash) via a crafted JPEG file, related to the Exif marker.CVE-2014-90937.5LibreOffice before 4.3.5 allows remote attackers to cause a denial of service (invalid write operation and crash) and possibly execute arbit CVE-2014-90944.3Multiple cross-site scripting (XSS) vulnerabilities in deploy/designer/preview.php in the Digital Zoom Studio (DZS) Video Gallery plugin for CVE-2014-90957.5Multiple SQL injection vulnerabilities in Raritan Power IQ 4.1.0 and 4.2.1 allow remote attackers to execute arbitrary SQL commands via the CVE-2014-90967.5Multiple SQL injection vulnerabilities in recover.php in Pligg CMS 2.0.1 and earlier allow remote attackers to execute arbitrary SQL command CVE-2014-90977.5Multiple SQL injection vulnerabilities in the Apptha WordPress Video Gallery (contus-video-gallery) plugin 2.5, possibly as distributed befo CVE-2014-90983.5Multiple cross-site scripting (XSS) vulnerabilities in the Apptha WordPress Video Gallery (contus-video-gallery) plugin 2.5, possibly before