Servers and applications
CVE-2014-1895
Off-by-one error in the flask_security_avc_cachestats function in xsm/flask/flask_op.c in Xen 4.2.x and 4.3.x, when the maximum number of physical CPUs are in use, allows local users to cause a denial of service (host crash) or obtain sensitive information from hypervisor memory by leveraging a FLASK_AVC_CACHESTAT hypercall, which triggers a buffer over-read.
- Severity
- Medium 5.8
- Published
- 1 Apr 2014
- Last changed
- 17 Jun 2026
- Added to UpHeron
- 1 Nov 2026
- Exploit chance
- 0.5% in the next 30 daysHigher than 45% of CVEs. EPSS by FIRST, 12 Nov 2026
- Weakness
- CWE-189
- Attack
- From the same local network · Needs a login
- Attacker can
- Read some data · Take it down
- CVSS vector
AV:A/AC:M/Au:S/C:P/I:N/A:C- Sources
- NVD
Affected software
| Software | Affected versions |
|---|---|
XenServers and applications · cpe:o:xen:xen |
|