Date: Thu, 07 Jul 2011 16:56:40 +0800 From: Eugene Teo <eugene@...hat.com> To: oss-security@...ts.openwall.com CC: "Steven M. Christey" <coley@...us.mitre.org> Subject: CVE-2011-1780, CVE-2011-1936, kernel/xen issues 1) CVE-2011-1780 kernel: xen: svm: insufficiencies in handling emulated instructions during vm exits A bug was found in the way Xen handles instruction emulation during VM exits. Malicious guest user space process running in SMP guest can trick the emulator into reading different instruction than the one that caused the VM exit. To do so it should run legitimate instruction that causes VM exit in one thread and replace this instruction to another one from second thread. An unprivileged guest user can potentially use this flaw to crash the host. Doesn't affect upstream. https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-1780 2) CVE-2011-1936 kernel: xen: vmx: insecure cpuid vmexit A bug was found in the way Xen handles cpuid instruction emulation during VM exits. An unprivileged guest user can potentially use this flaw to crash the guest. This issue only affects systems running on x86 architecture with Intel processor and VMX virtualization extension enabled. Doesn't affect upstream. https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-1936 Thanks, Eugene
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ