Date: Tue, 13 Nov 2012 12:56:10 +0000 From: Xen.org security team <security@....org> To: xen-announce@...ts.xen.org, xen-devel@...ts.xen.org, xen-users@...ts.xen.org, oss-security@...ts.openwall.com CC: Xen.org security team <security@....org> Subject: Xen Security Advisory 21 (CVE-2012-4536) - pirq range check DoS vulnerability -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Xen Security Advisory CVE-2012-4536 / XSA-21 version 2 pirq range check DoS vulnerability UPDATES IN VERSION 2 ==================== Public release. ISSUE DESCRIPTION ================= domain_pirq_to_emuirq() uses the guest provided pirq value before range checking it, and physdev_unmap_pirq uses domain_pirq_to_emuirq without checking the pirq value either. Invalid pirq values can cause Xen to read out of array bounds, usually resulting in a fatal page fault. IMPACT ====== A malicious guest administrator can cause Xen to crash. If the out of array bounds access does not crash, the arbitrary value read will be ignored due to later error checking, so there is no privilege escalation and no exploitable information leak. VULNERABLE SYSTEMS ================== Only Xen version 4.1 is vulnerable. Other released versions, and xen-unstable, are not vulnerable. The vulnerability is only exposed to HVM guests. MITIGATION ========== Running only PV guests, or ensuring that HVM guests only use trusted kernels, will avoid this vulnerability. RESOLUTION ========== The attached patch resolves this issue. $ sha256sum xsa21.patch 34c4bef71d0ad08ee7c337c77af47aa77bb19081a13fc13beaff7d4b37b6b35a xsa21.patch $ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) iQEcBAEBAgAGBQJQokGnAAoJEIP+FMlX6CvZ1lQH/jdovmPuphnocdrkWGR8FE3+ OqM3JIpOZTDPFfLO7pen/P5e/0fCBs7cF7FGvM1Uua54/M0HrVS93E1m9baornkh vEIV5c9TRTfUR3IGmVFs1l+ddJcfULOuhfE2IOrbcYaWBL89D9sQYrL/A1j4LTEh umsz6fh4XgINkt/tpneEcE4ckYd0YkkOm3zUK3HaGshNXoOGVyGeaNqKr/YuhEfc XWOkCUoZTxKz50Tg12pdtjX8CX0njJaKeAs0MLkyTL1cj+Sf89YzNuXLwx5ffpMu //VEe2tbyRzPj2JYzUOrV8E5W1fPZmfCSgMvJEtwmMbMXMb7sIUPMBh3yBcXQQU= =yPnD -----END PGP SIGNATURE----- Download attachment "xsa21.patch" of type "application/octet-stream" (1069 bytes)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.