CVE-2014-5149

Certain MMU virtualization operations in Xen 4.2.x through 4.4.x, when using shadow pagetables, are not preemptible, which allows local HVM guest to cause a denial of service (vcpu consumption) by invoking these operations, which process every page assigned to a guest, a different vulnerability than CVE-2014-5146.

• CWE-399

• http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136980.html
• http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136981.html
• http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00005.htmlThird Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00010.htmlThird Party Advisory
• http://www.securityfocus.com/bid/69199Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1030723Third Party Advisory, VDB Entry
• http://xenbits.xen.org/xsa/advisory-97.htmlPatch, Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/95235
• https://security.gentoo.org/glsa/201504-04
• http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136980.html
• http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136981.html
• http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00005.htmlThird Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00010.htmlThird Party Advisory
• http://www.securityfocus.com/bid/69199Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1030723Third Party Advisory, VDB Entry
• http://xenbits.xen.org/xsa/advisory-97.htmlPatch, Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/95235
• https://security.gentoo.org/glsa/201504-04

Published

Aug 22, 2014

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2014-5139The ssl_set_client_disabled function in t1_lib.c in OpenSSL …
• CVE-2014-5140The bindReplace function in the query factory in includes/cl…8.8
• CVE-2014-5144Cross-site scripting (XSS) vulnerability in Telescope before…
• CVE-2014-5146Certain MMU virtualization operations in Xen 4.2.x through 4…
• CVE-2014-5147Xen 4.4.x, when running a 64-bit kernel on an ARM system, do…
• CVE-2014-5148Xen 4.4.x, when running on an ARM system and "handling an un…
• CVE-2014-5157Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2014-5158The (1) av-centerd SOAP service and (2) backup command in th…
• CVE-2014-5159SQL injection vulnerability in the ossim-framework service i…
• CVE-2014-5160Multiple directory traversal vulnerabilities in crs.exe in t…
• CVE-2014-5161The dissect_log function in plugins/irda/packet-irda.c in th…
• CVE-2014-5162The read_new_line function in wiretap/catapult_dct2000.c in …