Xen Denial of Service Vulnerability (CVE-2014-3717)

Release date:
Updated on:

Affected Systems:
XenSource Xen 4.4.x
Description:
--------------------------------------------------------------------------------
CVE (CAN) ID: CVE-2014-3717
 
Xen is an open-source Virtual Machine monitor developed by the University of Cambridge.

In Xen 4.4.x, the 64-bit ARM client kernel loading address is not correctly verified. This allows local users to trigger buffer overflow through a specially crafted kernel, read system memory, or cause DOS.
 
<* Source: Xen.org security team (security@xen.org)
Thomas Leonard

Link: http://xenbits.xen.org/xsa/advisory-95.html
*>

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:
 
XenSource
---------
XenSource has released a Security Bulletin (advisory-95) and corresponding patches for this:
Advisory-95: Xen Security Advisory CVE-2014-3714, CVE-2014-3715, CVE-2014-3716/CVE-2014-3717 version 3
Link: http://xenbits.xen.org/xsa/advisory-95.html
 
Patch download: http://xenbits.xen.org/xsa/xsa95.patch

How does XenServer add local storage?

Enable and configure the SNMP service for Citrix XenServer

Install XS-Tools (XenServer) in CentOS/Linux)

XenServer Tutorial: How to Implement hot migration

This article permanently updates the link address: