Vulnerability Details : CVE-2014-3672
The qemu implementation in libvirt before 1.3.0 and Xen allows local guest OS users to cause a denial of service (host disk consumption) by writing to stdout or stderr.
Vulnerability category: Denial of service
Products affected by CVE-2014-3672
- cpe:2.3:a:redhat:libvirt:*:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2014-3672
0.06%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 16 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2014-3672
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
2.1
|
LOW | AV:L/AC:L/Au:N/C:N/I:N/A:P |
3.9
|
2.9
|
NIST | |
|
6.5
|
MEDIUM | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H |
2.0
|
4.0
|
NIST |
CWE ids for CVE-2014-3672
-
The product does not properly control the allocation and maintenance of a limited resource.Assigned by: nvd@nist.gov (Primary)
References for CVE-2014-3672
-
https://libvirt.org/news-2015.html
libvirt: Releases (2015)Release Notes;Vendor Advisory
-
http://www.securitytracker.com/id/1035945
Xen libxl Logging Lets Local Users on a Guest System Cause Denial of Service Conditions on the Guest System - SecurityTrackerThird Party Advisory;VDB Entry
-
https://libvirt.org/git/?p=libvirt.git%3Ba=commit%3Bh=0d968ad715475a1660779bcdd2c5b38ad63db4cf
libvirt.org Git
-
http://www.openwall.com/lists/oss-security/2016/05/24/5
oss-security - CVE-2014-3672 libvirt: DoS via excessive loggingMailing List
-
http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html
Oracle VM Server for x86 Bulletin - July 2016Third Party Advisory
-
http://xenbits.xen.org/xsa/advisory-180.html
XSA-180 - Xen Security AdvisoriesVendor Advisory
Jump to