CVE-2014-1896: Xen

Medium severity, CVSS 4.9. EPSS: 0.5% chance of exploitation in the next 30 days.

The (1) do_send and (2) do_recv functions in io.c in libvchan in Xen 4.2.x, 4.3.x, and 4.4-RC series allows local guests to cause a denial of service or possibly gain privileges via crafted xenstore ring indexes, which triggers a "read or write past the end of the ring."

Affected products

• Xen Xen: version 4.2.0 only; version 4.2.1 only; version 4.2.2 only; version 4.2.3 only; version 4.3.0 only; version 4.3.1 only; …

Published 2014-04-01. Last modified 2026-06-17.