oss-security - CVE-2011-1780, CVE-2011-1936, kernel/xen issues

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Date: Thu, 07 Jul 2011 16:56:40 +0800
From: Eugene Teo <eugene@...hat.com>
To: oss-security@...ts.openwall.com
CC: "Steven M. Christey" <coley@...us.mitre.org>
Subject: CVE-2011-1780, CVE-2011-1936, kernel/xen issues

1) CVE-2011-1780 kernel: xen: svm: insufficiencies in handling emulated
instructions during vm exits

A bug was found in the way Xen handles instruction emulation during VM
exits. Malicious guest user space process running in SMP guest can trick
the emulator into reading different instruction than the one that caused
the VM exit. To do so it should run legitimate instruction that causes
VM exit in one thread and replace this instruction to another one from
second thread. An unprivileged guest user can potentially use this flaw
to crash the host. Doesn't affect upstream.

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-1780

2) CVE-2011-1936 kernel: xen: vmx: insecure cpuid vmexit
A bug was found in the way Xen handles cpuid instruction emulation
during VM exits. An unprivileged guest user can potentially use this
flaw to crash the guest.

This issue only affects systems running on x86 architecture with Intel
processor and VMX virtualization extension enabled. Doesn't affect upstream.

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-1936

Thanks, Eugene

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.