oss-security - Re: CVE request: xen: x86-64: don't crash Xen upon direct pv guest access

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <1561504.844751291131757945.JavaMail.root@zmail01.collab.prod.int.phx2.redhat.com>
Date: Tue, 30 Nov 2010 10:42:37 -0500 (EST)
From: Josh Bressers <bressers@...hat.com>
To: oss-security@...ts.openwall.com
Cc: "Steven M. Christey" <coley@...us.mitre.org>,
        Marcus Meissner <meissner@...e.de>
Subject: Re: CVE request: xen: x86-64: don't crash Xen upon
 direct pv guest access

Please use CVE-2010-4255 for this.

Thanks.

-- 
    JB


----- "Eugene Teo" <eugene@...hat.com> wrote:

> handle_gdt_ldt_mapping_fault() is intended to deal with indirect 
> accesses (i.e. those caused by descriptor loads) to the GDT/LDT
> mapping 
> area only. While for 32-bit segment limits indeed prevent the function
> 
> being entered for direct accesses (i.e. a #GP fault will be raised
> even 
> before the address translation gets done, on 64-bit even user mode 
> accesses would lead to control reaching the BUG_ON() at the beginning
> of 
> that function.
> 
> http://lists.xensource.com/archives/html/xen-devel/2010-11/msg01650.html
> https://bugzilla.redhat.com/show_bug.cgi?id=658155
> 
> Thanks, Eugene

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.