Xen.org security team
2012-Nov-13 12:56 UTC
Xen Security Advisory 21 (CVE-2012-4536) - pirq range check DoS vulnerability
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Xen Security Advisory CVE-2012-4536 / XSA-21
version 2
pirq range check DoS vulnerability
UPDATES IN VERSION 2
===================
Public release.
ISSUE DESCRIPTION
================
domain_pirq_to_emuirq() uses the guest provided pirq value before
range checking it, and physdev_unmap_pirq uses domain_pirq_to_emuirq
without checking the pirq value either. Invalid pirq values can cause
Xen to read out of array bounds, usually resulting in a fatal page
fault.
IMPACT
=====
A malicious guest administrator can cause Xen to crash. If the out of
array bounds access does not crash, the arbitrary value read will be
ignored due to later error checking, so there is no privilege
escalation and no exploitable information leak.
VULNERABLE SYSTEMS
=================
Only Xen version 4.1 is vulnerable. Other released versions, and
xen-unstable, are not vulnerable.
The vulnerability is only exposed to HVM guests.
MITIGATION
=========
Running only PV guests, or ensuring that HVM guests only use trusted
kernels, will avoid this vulnerability.
RESOLUTION
=========
The attached patch resolves this issue.
$ sha256sum xsa21.patch
34c4bef71d0ad08ee7c337c77af47aa77bb19081a13fc13beaff7d4b37b6b35a xsa21.patch
$
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
iQEcBAEBAgAGBQJQokGnAAoJEIP+FMlX6CvZ1lQH/jdovmPuphnocdrkWGR8FE3+
OqM3JIpOZTDPFfLO7pen/P5e/0fCBs7cF7FGvM1Uua54/M0HrVS93E1m9baornkh
vEIV5c9TRTfUR3IGmVFs1l+ddJcfULOuhfE2IOrbcYaWBL89D9sQYrL/A1j4LTEh
umsz6fh4XgINkt/tpneEcE4ckYd0YkkOm3zUK3HaGshNXoOGVyGeaNqKr/YuhEfc
XWOkCUoZTxKz50Tg12pdtjX8CX0njJaKeAs0MLkyTL1cj+Sf89YzNuXLwx5ffpMu
//VEe2tbyRzPj2JYzUOrV8E5W1fPZmfCSgMvJEtwmMbMXMb7sIUPMBh3yBcXQQU=yPnD
-----END PGP SIGNATURE-----
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
http://lists.xen.org/xen-devel