oss-security - Xen Security Advisory 21 (CVE-2012-4536) - pirq range check DoS vulnerability

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <E1TYG2E-0000zH-Ug@xenbits.xen.org>
Date: Tue, 13 Nov 2012 12:56:10 +0000
From: Xen.org security team <security@....org>
To: xen-announce@...ts.xen.org, xen-devel@...ts.xen.org,
 xen-users@...ts.xen.org, oss-security@...ts.openwall.com
CC: Xen.org security team <security@....org>
Subject: Xen Security Advisory 21 (CVE-2012-4536) - pirq range check DoS
 vulnerability

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

                 Xen Security Advisory CVE-2012-4536 / XSA-21
                                version 2

                    pirq range check DoS vulnerability

UPDATES IN VERSION 2
====================

Public release.

ISSUE DESCRIPTION
=================

domain_pirq_to_emuirq() uses the guest provided pirq value before
range checking it, and physdev_unmap_pirq uses domain_pirq_to_emuirq
without checking the pirq value either.  Invalid pirq values can cause
Xen to read out of array bounds, usually resulting in a fatal page
fault.

IMPACT
======

A malicious guest administrator can cause Xen to crash.  If the out of
array bounds access does not crash, the arbitrary value read will be
ignored due to later error checking, so there is no privilege
escalation and no exploitable information leak.

VULNERABLE SYSTEMS
==================

Only Xen version 4.1 is vulnerable.  Other released versions, and
xen-unstable, are not vulnerable.

The vulnerability is only exposed to HVM guests.

MITIGATION
==========

Running only PV guests, or ensuring that HVM guests only use trusted
kernels, will avoid this vulnerability.

RESOLUTION
==========

The attached patch resolves this issue.

$ sha256sum xsa21.patch
34c4bef71d0ad08ee7c337c77af47aa77bb19081a13fc13beaff7d4b37b6b35a  xsa21.patch
$
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)

iQEcBAEBAgAGBQJQokGnAAoJEIP+FMlX6CvZ1lQH/jdovmPuphnocdrkWGR8FE3+
OqM3JIpOZTDPFfLO7pen/P5e/0fCBs7cF7FGvM1Uua54/M0HrVS93E1m9baornkh
vEIV5c9TRTfUR3IGmVFs1l+ddJcfULOuhfE2IOrbcYaWBL89D9sQYrL/A1j4LTEh
umsz6fh4XgINkt/tpneEcE4ckYd0YkkOm3zUK3HaGshNXoOGVyGeaNqKr/YuhEfc
XWOkCUoZTxKz50Tg12pdtjX8CX0njJaKeAs0MLkyTL1cj+Sf89YzNuXLwx5ffpMu
//VEe2tbyRzPj2JYzUOrV8E5W1fPZmfCSgMvJEtwmMbMXMb7sIUPMBh3yBcXQQU=
=yPnD
-----END PGP SIGNATURE-----

Download attachment "xsa21.patch" of type "application/octet-stream" (1069 bytes)

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.