{"id":"CVE-2014-2580","aliases":["DEBIAN-CVE-2014-2580","EUVD-2014-2612","GHSA-w8xc-4fv7-23hg","UBUNTU-CVE-2014-2580","USN-2226-1"],"status":"published","title":"The netback driver in Xen, when using certain Linux versions that do not allow sleeping in...","description":"The netback driver in Xen, when using certain Linux versions that do not allow sleeping in softirq context, allows local guest administrators to cause a denial of service (\"scheduling while atomic\" error and host crash) via a malformed packet, which causes a mutex to be taken when trying to disable the interface.","severity":{"version":"2.0","score":4.4,"vector":"AV:L/AC:M/Au:S/C:N/I:N/A:C","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.00343,"percentile":0.27999,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-399"],"published":"2014-04-15T00:00:00Z","modified":"2026-10-23T15:47:25Z","fixes":[{"ecosystem":"Debian:12","package":"linux","fixed_in":["3.13.10-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"linux","fixed_in":["3.13.10-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"linux","fixed_in":["3.13.10-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"linux","fixed_in":["3.13.0-27.50"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.10-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.10-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.10-1"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.0-27.50"}]}],"versions":["3.11.0-12.19","3.12.0-1.3","3.12.0-2.5","3.12.0-2.7","3.12.0-3.8","3.12.0-3.9","3.12.0-4.10","3.12.0-4.12","3.12.0-5.13","3.12.0-7.15","3.13.0-1.16","3.13.0-2.17","3.13.0-3.18","3.13.0-4.19","3.13.0-5.20","3.13.0-6.23","3.13.0-7.25","3.13.0-7.26","3.13.0-8.27","3.13.0-8.28","3.13.0-10.30","3.13.0-11.31","3.13.0-12.32","3.13.0-13.33","3.13.0-14.34","3.13.0-15.35","3.13.0-16.36","3.13.0-17.37","3.13.0-18.38","3.13.0-19.39","3.13.0-19.40","3.13.0-20.42","3.13.0-21.43","3.13.0-22.44","3.13.0-23.45","3.13.0-24.46","3.13.0-24.47"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.0-27.50"}]}],"versions":["3.11.0-12.19","3.12.0-1.3","3.12.0-2.5","3.12.0-2.7","3.12.0-3.8","3.12.0-3.9","3.12.0-4.10","3.12.0-4.12","3.12.0-5.13","3.12.0-7.15","3.13.0-1.16","3.13.0-2.17","3.13.0-3.18","3.13.0-4.19","3.13.0-5.20","3.13.0-6.23","3.13.0-7.25","3.13.0-7.26","3.13.0-8.27","3.13.0-8.28","3.13.0-10.30","3.13.0-11.31","3.13.0-12.32","3.13.0-13.33","3.13.0-14.34","3.13.0-15.35","3.13.0-16.36","3.13.0-17.37","3.13.0-18.38","3.13.0-19.39","3.13.0-19.40","3.13.0-20.42","3.13.0-21.43","3.13.0-22.44","3.13.0-23.45","3.13.0-24.46","3.13.0-24.47"],"bundled":6}],"products":[{"vendor":"xen","product":"xen"}],"references":[{"url":"http://xenbits.xen.org/xsa/advisory-90.html","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","advisory","fix"]},{"url":"http://www.openwall.com/lists/oss-security/2014/03/24/8","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://www.securityfocus.com/bid/66386","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"http://www.openwall.com/lists/oss-security/2014/03/24/6","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://www.securitytracker.com/id/1029949","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-2580"},{"url":"https://github.com/advisories/GHSA-w8xc-4fv7-23hg"},{"url":"https://security-tracker.debian.org/tracker/CVE-2014-2580","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2014-2580","tags":["report"]},{"url":"http://www.openwall.com/lists/oss-security/2014/03/25","tags":["report"]},{"url":"http://xenbits.xenproject.org/xsa/advisory-90.html","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2226-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-2260-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-2580","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-0077","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-1737","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-1738","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-2851","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-7283","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2014-2580","description":"The netback driver in Xen, when using certain Linux versions that do not allow sleeping in softirq context, allows local guest administrators to cause a denial of service (\"scheduling while atomic\" error and host crash) via a malformed packet, which causes a mutex to be taken when trying to disable the interface.","status":"published","published":"2014-04-15T17:00:00Z","modified":"2024-08-06T10:21:35.216Z","updated_at":"2026-11-02T14:33:44.23164Z"}],"euvd":[{"id":"EUVD-2014-2612","description":"The netback driver in Xen, when using certain Linux versions that do not allow sleeping in softirq context, allows local guest administrators to cause a denial of service (\"scheduling while atomic\" error and host crash) via a malformed packet, which causes a mutex to be taken when trying to disable the interface.","status":"published","published":"2014-04-15T17:00:00Z","modified":"2024-08-06T10:21:35Z","updated_at":"2026-11-03T01:57:14.00634Z"}],"ghsa":[{"id":"GHSA-w8xc-4fv7-23hg","title":"The netback driver in Xen, when using certain Linux versions that do not allow sleeping in...","description":"The netback driver in Xen, when using certain Linux versions that do not allow sleeping in softirq context, allows local guest administrators to cause a denial of service (\"scheduling while atomic\" error and host crash) via a malformed packet, which causes a mutex to be taken when trying to disable the interface.","status":"published","published":"2022-05-17T04:47:02Z","modified":"2023-01-28T05:02:33Z","updated_at":"2026-11-02T14:43:48.368168Z"}],"nvd":[{"id":"CVE-2014-2580","description":"The netback driver in Xen, when using certain Linux versions that do not allow sleeping in softirq context, allows local guest administrators to cause a denial of service (\"scheduling while atomic\" error and host crash) via a malformed packet, which causes a mutex to be taken when trying to disable the interface.","status":"published","published":"2014-04-15T23:13:13.337Z","modified":"2026-06-17T00:06:50.08Z","cvss":[{"version":"2.0","score":4.4,"vector":"AV:L/AC:M/Au:S/C:N/I:N/A:C","level":"medium","assessor":"primary"}],"cwes":["CWE-399"],"updated_at":"2026-11-02T14:02:53.710973Z"}],"osv":[{"id":"CVE-2014-2580","description":"The netback driver in Xen, when using certain Linux versions that do not allow sleeping in softirq context, allows local guest administrators to cause a denial of service (\"scheduling while atomic\" error and host crash) via a malformed packet, which causes a mutex to be taken when trying to disable the interface.","status":"published","published":"2014-04-15T23:13:13Z","modified":"2026-04-10T03:44:38.838878Z","updated_at":"2026-11-02T15:43:59.361892Z"},{"id":"DEBIAN-CVE-2014-2580","description":"The netback driver in Xen, when using certain Linux versions that do not allow sleeping in softirq context, allows local guest administrators to cause a denial of service (\"scheduling while atomic\" error and host crash) via a malformed packet, which causes a mutex to be taken when trying to disable the interface.","status":"published","published":"2014-04-15T23:13:13.337Z","modified":"2026-10-23T15:47:25.875137846Z","updated_at":"2026-11-02T15:45:26.134753Z"},{"id":"UBUNTU-CVE-2014-2580","description":"The netback driver in Xen, when using certain Linux versions that do not allow sleeping in softirq context, allows local guest administrators to cause a denial of service (\"scheduling while atomic\" error and host crash) via a malformed packet, which causes a mutex to be taken when trying to disable the interface.","status":"published","published":"2014-04-15T00:00:00Z","modified":"2026-04-22T09:38:14.765838Z","updated_at":"2026-11-02T15:54:09.010095Z"},{"id":"USN-2226-1","title":"linux vulnerabilities","description":"\nMatthew Daley reported an information leak in the floppy disk driver of the\nLinux kernel. An unprivileged local user could exploit this flaw to obtain\npotentially sensitive information from kernel memory. (CVE-2014-1738)\n\nMatthew Daley reported a flaw in the handling of ioctl commands by the\nfloppy disk driver in the Linux kernel. An unprivileged local user could\nexploit this flaw to gain administrative privileges if the floppy disk\nmodule is loaded. (CVE-2014-1737)\n\nA flaw was discovered in the handling of network packets when mergeable\nbuffers are disabled for virtual machines in the Linux kernel. Guest OS\nusers may exploit this flaw to cause a denial of service (host OS crash) or\npossibly gain privilege on the host OS. (CVE-2014-0077)\n\nTörök Edwin discovered a flaw with Xen netback driver when used with\nLinux configurations that do not allow sleeping in softirq context. A guest\nadministrator could exploit this flaw to cause a denial of service (system\ncrash) on the host. (CVE-2014-2580)\n\nA flaw was discovered in the Linux kernel's ping sockets. An unprivileged\nlocal user could exploit this flaw to cause a denial of service (system\ncrash) or possibly gain privileges via a crafted application.\n(CVE-2014-2851)\n\nHannes Frederic Sowa reported a hash collision ordering problem in the xfs\nfilesystem in the Linux kernel. A local user could exploit this flaw to\ncause filesystem corruption and a denial of service (oops or panic).\n(CVE-2014-7283)\n","status":"published","published":"2014-05-27T06:49:10Z","modified":"2026-04-22T08:53:13.893239Z","updated_at":"2026-11-02T16:58:09.227524Z"}]}}