CVE-2014-5149

Name	CVE-2014-5149
Description	Certain MMU virtualization operations in Xen 4.2.x through 4.4.x, when using shadow pagetables, are not preemptible, which allows local HVM guest to cause a denial of service (vcpu consumption) by invoking these operations, which process every page assigned to a guest, a different vulnerability than CVE-2014-5146.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severity	medium
Debian Bugs	770230

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
xen (PTS)	stretch (security), stretch	4.8.5.final+shim4.10.4-1+deb9u12	fixed
	buster	4.11.4+57-g41a822c392-2	fixed
	buster (security)	4.11.4+99-g8bce4698f6-1	fixed
	bullseye, sid	4.14.1+11-gb0b734a8b3-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
xen	source	squeeze	(unfixed)	end-of-life
xen	source	(unstable)	4.4.1-4	low		770230

[wheezy] - xen <no-dsa> (Minor issue, too intrusive to backport)
[squeeze] - xen <end-of-life> (Unsupported in squeeze-lts)