01 Record

CVE-2014-1891

Multiple integer overflows in the (1) FLASK_GETBOOL, (2) FLASK_SETBOOL, (3) FLASK_USER, and (4) FLASK_CONTEXT_TO_SID suboperations in the flask hypercall in Xen 4.3.x, 4.2.x, 4.1.x, 3.2.x, and

UnratedPUBLISHEDCNA: mitre

CNA base scoreUnratedNo CNA CVSS vector

View raw JSON

02 Description

Multiple integer overflows in the (1) FLASK_GETBOOL, (2) FLASK_SETBOOL, (3) FLASK_USER, and (4) FLASK_CONTEXT_TO_SID suboperations in the flask hypercall in Xen 4.3.x, 4.2.x, 4.1.x, 3.2.x, and

03 Exploitation and scoring

Exploitation: Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.
SSVC decision: Not assessed by CISA
EPSS probability: 0.54% probability of exploitation activity in the next 30 days.
EPSS percentile: Equal to or higher than the score of 45.5% of scored records. A rank, not a probability.
NVD base score: The NVD has published no score for this record
NVD CVSS vector: No NVD score to derive
NVD analysis status: Modified. NVD last modified this record on 2026-06-17.
Red Hat severity: Moderate. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2014-04-01 01:00Z12 YR AGO

Last updated

2024-08-06 09:58Z2 YR AGO

Reserved

2014-02-07

Assigning CNA

mitre

Record state

PUBLISHED

Severity

Not rated by the issuing CNA

CNA CVSS vector

Not published by the issuing CNA

Weaknesses

CWE-189
CWE-190Integer Overflow or WraparoundBase

Data version

5.1

Document digest

16ff1b5ad37065d396906bd1bd61bed2d4ccff85b58c1066339ffbccdea7edde

05 Affected products

VendorProductVersionsPlatforms

redhatenterprise_linuxNot specified—

xenxenNot specified—

06 References

lists.opensuse.orgSUSE-SU-2014:0373http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00011.htmlvendor-advisoryx_refsource_SUSE
www.openwall.com[oss-security] 20140210 Xen Security Advisory 84 (CVE-2014-1891,CVE-2014-1892,CVE-2014-1893,CVE-2014-1894) - integer overflow in several XSM/Flask hypercallshttp://www.openwall.com/lists/oss-security/2014/02/10/8mailing-listx_refsource_MLIST
xenbits.xen.orghttp://xenbits.xen.org/xsa/advisory-84.htmlx_refsource_CONFIRM
www.openwall.com[oss-security] 20140207 Re: Xen Security Advisory 84 - integer overflow in several XSM/Flask hypercallshttp://www.openwall.com/lists/oss-security/2014/02/07/4mailing-listx_refsource_MLIST
security.gentoo.orgGLSA-201407-03http://security.gentoo.org/glsa/glsa-201407-03.xmlvendor-advisoryx_refsource_GENTOO
lists.opensuse.orgSUSE-SU-2014:0372http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00010.htmlvendor-advisoryx_refsource_SUSE
lists.opensuse.orgSUSE-SU-2014:0446http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00021.htmlvendor-advisoryx_refsource_SUSE
www.openwall.com[oss-security] 20140207 Re: Xen Security Advisory 84 - integer overflow in several XSM/Flask hypercallshttp://www.openwall.com/lists/oss-security/2014/02/07/12mailing-listx_refsource_MLIST