#VU41812 Resource management error in Xen - CVE-2014-2580

Vulnerability identifier: #VU41812

Vulnerability risk: Low

CVSSv4.0: 4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2014-2580

CWE-ID: CWE-399

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Xen
Server applications / Virtualization software

Vendor: Xen Project

Description

The vulnerability allows a local #AU# to perform a denial of service (DoS) attack.

The netback driver in Xen, when using certain Linux versions that do not allow sleeping in softirq context, allows local guest administrators to cause a denial of service ("scheduling while atomic" error and host crash) via a malformed packet, which causes a mutex to be taken when trying to disable the interface.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Xen: All versions

---

External links
https://www.openwall.com/lists/oss-security/2014/03/24/6
https://www.openwall.com/lists/oss-security/2014/03/24/8
https://www.securityfocus.com/bid/66386
https://www.securitytracker.com/id/1029949
https://xenbits.xen.org/xsa/advisory-90.html

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.