[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-Id: <E1WDazc-0002Lp-Nh@xenbits.xen.org>
Date: Wed, 12 Feb 2014 14:40:52 +0000
From: Xen.org security team <security@....org>
To: xen-announce@...ts.xen.org, xen-devel@...ts.xen.org,
xen-users@...ts.xen.org, oss-security@...ts.openwall.com
CC: Xen.org security team <security@....org>
Subject: Xen Security Advisory 88 - use-after-free in xc_cpupool_getinfo()
under memory pressure
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Xen Security Advisory XSA-88
version 2
use-after-free in xc_cpupool_getinfo() under memory pressure
UPDATES IN VERSION 2
====================
Public release.
ISSUE DESCRIPTION
=================
If xc_cpumap_alloc() fails then xc_cpupool_getinfo() will free and incorrectly
return the then-free pointer to the result structure.
IMPACT
======
An attacker may be able to cause a multi-threaded toolstack using this
function to race against itself leading to heap corruption and a
potential DoS.
Depending on the malloc implementation, privilege escalation cannot be
ruled out.
VULNERABLE SYSTEMS
==================
The flaw is present in Xen 4.1 onwards. Only multithreaded toolstacks
are vulnerable. Only systems where management functions (such as
domain creation) are exposed to untrusted users are vulnerable.
xl is not multithreaded, so is not vulnerable. However, multithreaded
toolstacks using libxl as a library are vulnerable. xend is
vulnerable.
MITIGATION
==========
Not allowing untrusted users access to toolstack functionality will
avoid this issue.
CREDITS
=======
This issue was discovered by Coverity Scan and diagnosed by Andrew
Cooper.
RESOLUTION
==========
Applying the attached patch resolves this issue.
xsa88.patch xen-unstable, Xen 4.3.x, Xen 4.2.x, Xen 4.1.x
$ sha256sum xsa88*.patch
7a73ca9db19a9ffe6e8cd259fa71dc1299738f26fa024303f4ab38931db75f14 xsa88.patch
$
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
iQEcBAEBAgAGBQJS+4fOAAoJEIP+FMlX6CvZfUUH/2wyYKHOkEaEmcjUbuyUM3CT
8V9VgW4dhq/sk9p5SqR0xGB6N+f2XytCAFXI3kNmYjrs+jGK5cQgLjxMOwMKrpwm
PsHCAZnGNzYMy48JtEUieEfwZqH/jNci7qJWNVdPoKnULOEd9X0hTri7vg1CoDI2
DUBeLvmC5mCFBej4pcDGX++XsdL90EnGa0RfrrVfIVf16EfBjgr8KzLKXd1uBueC
yWKg5z24+HoRqFp3n3+Q9T6GN+npOj/78mrlXJ7onKepONAmLqg0J6g/1hHuc4hY
pwUnbSf0452FKTFs7KUodXoJNNX1i3IuOch9pBcKlrbT6K/g/qwMZ/Pl2Ir8a20=
=vA6e
-----END PGP SIGNATURE-----
Download attachment "xsa88.patch" of type "application/octet-stream" (851 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
