CVE-2014-0155

The ioapic_deliver function in virt/kvm/ioapic.c in the Linux kernel through 3.14.1 does not properly validate the kvm_irq_delivery_to_apic return value, which allows guest OS users to cause a denial of service (host OS crash) via a crafted entry in the redirection table of an I/O APIC. NOTE: the affected code was moved to the ioapic_service function before the vulnerability was announced.

• CWE-20

• http://git.kernel.org/cgit/virt/kvm/kvm.git/commit/?id=5678de3f15010b9022ee45673f33bcfc71d47b60Exploit, Patch, Vendor Advisory
• http://www.openwall.com/lists/oss-security/2014/04/07/2Mailing List, Patch, Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1081589Issue Tracking, Patch, Third Party Advisory
• http://git.kernel.org/cgit/virt/kvm/kvm.git/commit/?id=5678de3f15010b9022ee45673f33bcfc71d47b60Exploit, Patch, Vendor Advisory
• http://www.openwall.com/lists/oss-security/2014/04/07/2Mailing List, Patch, Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1081589Issue Tracking, Patch, Third Party Advisory

Published

Apr 14, 2014

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2014-0149Multiple cross-site scripting (XSS) vulnerabilities in Red H…
• CVE-2014-0150Integer overflow in the virtio_net_handle_mac function in hw…
• CVE-2014-0151Cross-site request forgery (CSRF) vulnerability in oVirt Eng…
• CVE-2014-0152Session fixation vulnerability in the web admin interface in…
• CVE-2014-0153The REST API in oVirt 3.4.0 and earlier stores session IDs i…
• CVE-2014-0154oVirt Engine before 3.5.0 does not include the HTTPOnly flag…
• CVE-2014-0156Awesome spawn contains OS command injection vulnerability, w…9.8
• CVE-2014-0157Cross-site scripting (XSS) vulnerability in the Horizon Orch…
• CVE-2014-0158Heap-based buffer overflow in the JPEG2000 image tile decode…
• CVE-2014-0159Buffer overflow in the GetStatistics64 remote procedure call…
• CVE-2014-0160The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 be…7.5
• CVE-2014-0161ovirt-engine-sdk-python before 3.4.0.7 and 3.5.0.4 does not …5.9