NVD

Id
30255  
Name
CVE-2014-1666  
Description
The do_physdev_op function in Xen 4.1.5, 4.1.6.1, 4.2.2 through 4.2.3, and 4.3.x does not properly restrict access to the (1) PHYSDEVOP_prepare_msix and (2) PHYSDEVOP_release_msix operations, which allows local PV guests to cause a denial of service (host or guest malfunction) or possibly gain privileges via unspecified vectors.  
Reject
 
CVSS Version
2  
CVSS Score
8.3  
Severity
High  
CVSS Base Score
8.3  
CVSS Impact Subscore
10  
CVSS Exploit Subscore
6.5  
CVSS Vector
(AV:A/AC:L/Au:N/C:C/I:C/A:C)  
Pub Date
2017-01-19  
Published
2014-01-26  
Modified Date
2017-01-06  
Seq
2014-1666  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
160150 30255 CVE-2014-1666 FEDORA-2014-1552  View
160151 30255 CVE-2014-1666 SUSE-SU-2014:0372  View
160152 30255 CVE-2014-1666 SUSE-SU-2014:0373  View
160153 30255 CVE-2014-1666 GLSA-201407-03  View
160154 30255 CVE-2014-1666 [oss-security] 20140123 Xen Security Advisory 87 (CVE-2014-1666) - PHYSDEVOP_{prepare,release}_msix exposed to unprivileged guests  View
160155 30255 CVE-2014-1666 65125  View
160156 30255 CVE-2014-1666 1029684  View
160157 30255 CVE-2014-1666 http://xenbits.xen.org/xsa/advisory-87.html  View
160158 30255 CVE-2014-1666 http://xenbits.xen.org/xsa/xsa87-unstable-4.3.patch  View
160159 30255 CVE-2014-1666 xen-cve20141666-priv-esc(90675)  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
12389 JVNDB-2014-001264 Xen の do_physdev_op 関数におけるサービス運用妨害 (DoS) の脆弱性 Xen の do_physdev_op 関数は、(1) PHYSDEVOP_prepare_msix および (2) PHYSDEVOP_release_msix 操作へのアクセスを適切に制限しないため、サービス運用妨害 (ホストまたはゲストの誤動作) 状態にされる、および権限を取得される脆弱性が存在します。 CVE-2014-1666 68953 CVE-2014-1666 30255 8.3 http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-001264.html 2014-01-23 2014-01-28 View