Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Wed, 21 May 2008 19:15:00 +0200
From: Jan Lieskovsky <jlieskov@...hat.com>
To: oss-security@...ts.openwall.com, vendor-sec@....de,
        "Steven M. Christey" <coley@...re.org>
Subject: [vendor-sec] New Xen ioemu: PVFB backend issue

Hello guys,

  on May the 15th, the following report has been posted to the
xen-unstable list:


Problem description:
====================

ioemu: Fix PVFB backend to limit frame buffer size

The recent fix to validate the frontend's frame buffer description
neglected to limit the frame buffer size correctly. This lets a
malicious frontend make the backend attempt to map an arbitrary amount
of guest memory, which could be useful for a denial of service attack
against dom0.

Proposed fix:
============

http://xenbits.xensource.com/xen-unstable.hg?rev/9044705960cb30cec385bdca7305bcf7db096721


As this vulnerability has security implications, we have assigned
CVE-2008-1952 to it. Please use it when referring to this issue.


Kind regards
Jan iankko Lieskovsky
RH kernel Security Response Team

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.