CVE-2014-4021

Severity: low (CVSS 2.7 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2014-06-18 · updated 2026-06-17
Weakness: CWE-119

Description

Xen 3.2.x through 4.4.x does not properly clean memory pages recovered from guests, which allows local guest OS users to obtain sensitive information via unspecified vectors.

Affected products

xen: 3.2.0, 3.2.1, 3.2.2, 3.2.3, 4.0.0, 4.0.1 (+18)

References

http://linux.oracle.com/errata/ELSA-2014-0926-1.html
http://linux.oracle.com/errata/ELSA-2014-0926.html
http://lists.fedoraproject.org/pipermail/package-announce/2014-July/135068.html
http://lists.fedoraproject.org/pipermail/package-announce/2014-July/135071.html
http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00002.html
http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00003.html
http://secunia.com/advisories/59208
http://secunia.com/advisories/60027
http://secunia.com/advisories/60130
http://secunia.com/advisories/60471
http://security.gentoo.org/glsa/glsa-201407-03.xml
http://support.citrix.com/article/CTX140984

Get alerted when CVE-2014-4021 or the next vulnerability affects your stack