CVE-2014-1950: Xen

Medium severity, CVSS 4.6. EPSS: 0.4% chance of exploitation in the next 30 days.

Use-after-free vulnerability in the xc_cpupool_getinfo function in Xen 4.1.x through 4.3.x, when using a multithreaded toolstack, does not properly handle a failure by the xc_cpumap_alloc function, which allows local users with access to management functions to cause a denial of service (heap corruption) and possibly gain privileges via unspecified vectors.

Affected products

• Xen Xen: version 4.1.1 only; version 4.1.2 only; version 4.1.3 only; version 4.1.4 only; version 4.1.5 only; version 4.1.6.1 only; …

Published 2014-02-14. Last modified 2026-06-17.