Date: Thu, 15 May 2014 13:16:22 -0400 (EDT) From: cve-assign@...re.org To: security@....org Cc: cve-assign@...re.org, oss-security@...ts.openwall.com Subject: Re: Xen Security Advisory 95 - input handling vulnerabilities loading guest kernel on ARM -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 > Xen Security Advisory XSA-95 We would like to model this one as having four distinct primary issues. In other words, although the concepts of missing validation are similar, and the impacts may be the same, the types of validation can be categorized separately. Thus, there are four CVE IDs. > When loading a 32-bit ARM guest kernel the Xen tools did not correctly > validate the length of the kernel against the actual image size. This > would then lead to an overrun on the input buffer when loading the > kernel into guest RAM. Use CVE-2014-3714. > Furthermore when checking a 32-bit guest kernel for an appended DTB, > the Xen tools were prone to additional overruns also leading to an > overrun on the input buffer when loading the kernel into guest RAM. Use CVE-2014-3715. > Also, the tools would access a field in the putative DTB header > without checking for its alignment. Use CVE-2014-3716. > When loading a 64-bit ARM guest kernel the tools similarly did not > fully validate the requested load addresses, possibly leading to an > overrun on the input buffer when loading the kernel into guest RAM. Use CVE-2014-3717. - -- CVE assignment team, MITRE CVE Numbering Authority M/S M300 202 Burlington Road, Bedford, MA 01730 USA [ PGP key available through http://cve.mitre.org/cve/request_id.html ] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (SunOS) iQEcBAEBAgAGBQJTdPXqAAoJEKllVAevmvmsHAQH/RZMLQmt/JDGo6O0ZnMkzyMH tTXkjVjZI6Y2+DV5pFza5McAg3GXjlIxJztmsoWxic0Q7YEaNlH4bgt4lscQyzhR xkBFkU7aRUP3k7FOpY55Sf9jER6NycgrnD3+hyQdeBrg5lkIpiw0eaOrIMzep1uE xlmRA1ZTrvDA3nMEBAJ1dxCmuAj2GpIqTO5vCKKAOnFfjuTVjoPHNBfdRb9biRZW vR3jJmmpnc6OdwuAdMKGrhGuKh0qQb7AH0JaGhB0i0C1R2ahxHl5X/xnnxkXCgIw Yz3MvGOGiS8r9dPwl6XPmuBK5Q/wAAWVQVA6uTZSZZX/fVdR6FkY71syIYk/NC4= =sfjR -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ