Every CVESearch/Get API key

CVE-2014-9066

Xen 4.4.x and earlier, when using a large number of VCPUs, does not properly handle read and...

4.7 MediumFix available

CVE-2014-9066 is a medium vulnerability (CVSS 4.7) in Xen, published December 9, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.40%, the 34th percentile. Fixed in xen 4.4.1-0ubuntu0.14.04.4.

What does this mean?
Severity
4.7 MediumCVSS 2.0, NVD
Exploit chance
0.40%EPSS, 34th percentile
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
4.4.1-0ubuntu0.14.04.4xen +7 more

Description

Xen 4.4.x and earlier, when using a large number of VCPUs, does not properly handle read and write locks, which allows local x86 guest users to cause a denial of service (write denial or NMI watchdog timeout and host crash) via a large number of read requests, a different vulnerability than CVE-2014-9065.

Exploit likelihood

0.40%Down 0.6 points since Feb 4, 2022
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
xen
Debian:12
All versions, plus listed versions
4.17.1+2-gb773c48e36-14.17.2+55-g0b56bed864-14.17.2+76-ge1f9cb16e2-14.17.2+76-ge1f9cb16e2-1~deb12u14.17.2-1
Show 22 moreShow less
4.17.3+10-g091466ba55-14.17.3+10-g091466ba55-1.14.17.3+10-g091466ba55-1.1~exp14.17.3+10-g091466ba55-1.1~exp24.17.3+10-g091466ba55-1~deb12u14.17.3+36-g54dacb5c02-14.17.5+23-ga4e5191dc0-14.17.5+23-ga4e5191dc0-1+deb12u14.17.5+72-g01140da4e8-14.17.7-0+deb12u14.19.0+14-g0918434e0f-1~exp14.19.1-14.19.1-1~exp14.19.1-1~exp44.20.0+68-g35cb38b222-14.20.0-14.20.0~rc2+1-gfcde5e0de8-1~exp14.20.2+37-g61ff35323e-14.20.2+7-g1badcf5035-14.20.2+7-g1badcf5035-24.20.3+127-gc42374a105-14.20.4+39-gf1e1321c87-1
None known
xen
Debian:13
All versions, plus listed versions
4.20.0+68-g35cb38b222-14.20.2+37-g61ff35323e-0+deb13u14.20.2+37-g61ff35323e-14.20.2+7-g1badcf5035-0+deb13u14.20.2+7-g1badcf5035-1
Show 5 moreShow less
4.20.2+7-g1badcf5035-24.20.3+127-gc42374a105-0+deb13u14.20.3+127-gc42374a105-14.20.4+39-gf1e1321c87-0+deb13u14.20.4+39-gf1e1321c87-1
None known
xen
Debian:14
All versions, plus listed versions
4.20.0+68-g35cb38b222-14.20.2+37-g61ff35323e-14.20.2+7-g1badcf5035-14.20.2+7-g1badcf5035-24.20.3+127-gc42374a105-14.20.4+39-gf1e1321c87-1
None known
xen
SUSE:Linux Enterprise Desktop 12
From an advisory covering 8 CVEs
before 4.4.1_10-9.1
4.4.1_10-9.1
xen
SUSE:Linux Enterprise Software Development Kit 12
From an advisory covering 8 CVEs
before 4.4.1_10-9.1
4.4.1_10-9.1
xen
SUSE:Linux Enterprise Server 12
From an advisory covering 8 CVEs
before 4.4.1_10-9.1
4.4.1_10-9.1
xen
SUSE:Linux Enterprise Server for SAP Applications 12
From an advisory covering 8 CVEs
before 4.4.1_10-9.1
4.4.1_10-9.1
xen
Ubuntu:14.04:LTS
before 4.4.1-0ubuntu0.14.04.4, plus listed versions
4.3.0-1ubuntu14.3.0-1ubuntu24.3.0-1ubuntu34.3.0-1ubuntu44.3.0-1ubuntu5
Show 8 moreShow less
4.4.0-0ubuntu34.4.0-0ubuntu44.4.0-0ubuntu54.4.0-0ubuntu5.14.4.0-0ubuntu5.24.4.1-0ubuntu0.14.04.14.4.1-0ubuntu0.14.04.24.4.1-0ubuntu0.14.04.3
4.4.1-0ubuntu0.14.04.4

What each source reports

NVD Score used4.7

Xen 4.4.x and earlier, when using a large number of VCPUs, does not properly handle read and write locks, which allows local x86 guest users to cause a denial of service (write denial or NMI watchdog timeout and host crash) via a large number of read requests, a different vulnerability than CVE-2014-9065.

Record
CVE-2014-9066
CVSS 2.0
4.7 MediumAV:L/AC:M/Au:N/C:N/I:N/A:C
Weakness
CWE-17
Updated
2026-11-02
CVE ListNo score

Xen 4.4.x and earlier, when using a large number of VCPUs, does not properly handle read and write locks, which allows local x86 guest users to cause a denial of service (write denial or NMI watchdog timeout and host crash) via a large number of read requests, a different vulnerability than CVE-2014-9065.

Record
CVE-2014-9066
Updated
2026-11-02
EUVDEUVD-2014-8892No score

Xen 4.4.x and earlier, when using a large number of VCPUs, does not properly handle read and write locks, which allows local x86 guest users to cause a denial of service (write denial or NMI watchdog timeout and host crash) via a large number of read requests, a different vulnerability than CVE-2014-9065.

Record
EUVD-2014-8892
Updated
2026-11-03
GitHub AdvisoriesGHSA-4f7c-f5r2-23hxNo score

Xen 4.4.x and earlier, when using a large number of VCPUs, does not properly handle read and...

Xen 4.4.x and earlier, when using a large number of VCPUs, does not properly handle read and write locks, which allows local x86 guest users to cause a denial of service (write denial or NMI watchdog timeout and host crash) via a large number of read requests, a different vulnerability than CVE-2014-9065.

Record
GHSA-4f7c-f5r2-23hx
Updated
2026-11-02
OSVNo score

Xen 4.4.x and earlier, when using a large number of VCPUs, does not properly handle read and write locks, which allows local x86 guest users to cause a denial of service (write denial or NMI watchdog timeout and host crash) via a large number of read requests, a different vulnerability than CVE-2014-9065.

Record
CVE-2014-9066
Updated
2026-11-02
OSVDEBIAN-CVE-2014-9066No score

Xen 4.4.x and earlier, when using a large number of VCPUs, does not properly handle read and write locks, which allows local x86 guest users to cause a denial of service (write denial or NMI watchdog timeout and host crash) via a large number of read requests, a different vulnerability than CVE-2014-9065.

Record
DEBIAN-CVE-2014-9066
Updated
2026-11-02
OSVSUSE-SU-2015:0613-1No score

Security update for Xen

The XEN hypervisor received updates to fix various security issues and bugs.

The following security issues were fixed:

  • CVE-2015-2151: XSA-123: A hypervisor memory corruption due to x86 emulator flaw.
  • CVE-2015-2045: XSA-122: Information leak through version information hypercall.
  • CVE-2015-2044: XSA-121: Information leak via internal x86 system device emulation.
  • CVE-2015-2152: XSA-119: HVM qemu was unexpectedly enabling emulated VGA graphics backends.
  • CVE-2014-3615: Information leakage when guest sets high graphics resolution.
  • CVE-2015-0361: XSA-116: A xen crash due to use after free on hvm guest teardown.
  • CVE-2014-9065, CVE-2014-9066: XSA-114: xen: p2m lock starvation.

Also the following bugs were fixed:

  • bnc#919098 - XEN blktap device intermittently fails to connect
  • bnc#882089 - Windows 2012 R2 fails to boot up with greater than 60 vcpus
  • bnc#903680 - Problems with detecting free loop devices on Xen guest startup
  • bnc#861318 - xentop reports 'Found interface vif101.0 but domain 101 does not exist.'
  • Update seabios to rel-1.7.3.1 which is the correct version for Xen 4.4
  • Enhancement to virsh/libvirtd 'send-key' command The xen side small fix. (FATE#317240)
  • bnc#901488 - Intel ixgbe driver assigns rx/tx queues per core resulting in irq problems on servers with a large amount of CPU cores
  • bnc#910254 - SLES11 SP3 Xen VT-d igb NIC doesn't work
  • Add domain_migrate_constraints_set API to Xend's http interface (FATE#317239)
  • Restore missing fixes from block-dmmd script
  • bnc#904255 - XEN boot hangs in early boot on UEFI system
  • bsc#912011 - high ping latency after upgrade to latest SLES11SP3 on xen Dom0
  • Fix missing banner by restoring the figlet program.
Record
SUSE-SU-2015:0613-1
Updated
2026-11-02
OSVUBUNTU-CVE-2014-9066No score

Xen 4.4.x and earlier, when using a large number of VCPUs, does not properly handle read and write locks, which allows local x86 guest users to cause a denial of service (write denial or NMI watchdog timeout and host crash) via a large number of read requests, a different vulnerability than CVE-2014-9065.

Record
UBUNTU-CVE-2014-9066
Updated
2026-11-02

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 29 moreShow less
PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open