[Xen-devel] Xen Security Advisory 21 (CVE-2012-4536) - pirq range check DoS vulnerability

[Xen.org security team <security@xxxxxxx>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

                 Xen Security Advisory CVE-2012-4536 / XSA-21
                                version 2

                    pirq range check DoS vulnerability

UPDATES IN VERSION 2
====================

Public release.

ISSUE DESCRIPTION
=================

domain_pirq_to_emuirq() uses the guest provided pirq value before
range checking it, and physdev_unmap_pirq uses domain_pirq_to_emuirq
without checking the pirq value either.  Invalid pirq values can cause
Xen to read out of array bounds, usually resulting in a fatal page
fault.

IMPACT
======

A malicious guest administrator can cause Xen to crash.  If the out of
array bounds access does not crash, the arbitrary value read will be
ignored due to later error checking, so there is no privilege
escalation and no exploitable information leak.

VULNERABLE SYSTEMS
==================

Only Xen version 4.1 is vulnerable.  Other released versions, and
xen-unstable, are not vulnerable.

The vulnerability is only exposed to HVM guests.

MITIGATION
==========

Running only PV guests, or ensuring that HVM guests only use trusted
kernels, will avoid this vulnerability.

RESOLUTION
==========

The attached patch resolves this issue.

$ sha256sum xsa21.patch
34c4bef71d0ad08ee7c337c77af47aa77bb19081a13fc13beaff7d4b37b6b35a  xsa21.patch
$
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)

iQEcBAEBAgAGBQJQokGnAAoJEIP+FMlX6CvZ1lQH/jdovmPuphnocdrkWGR8FE3+
OqM3JIpOZTDPFfLO7pen/P5e/0fCBs7cF7FGvM1Uua54/M0HrVS93E1m9baornkh
vEIV5c9TRTfUR3IGmVFs1l+ddJcfULOuhfE2IOrbcYaWBL89D9sQYrL/A1j4LTEh
umsz6fh4XgINkt/tpneEcE4ckYd0YkkOm3zUK3HaGshNXoOGVyGeaNqKr/YuhEfc
XWOkCUoZTxKz50Tg12pdtjX8CX0njJaKeAs0MLkyTL1cj+Sf89YzNuXLwx5ffpMu
//VEe2tbyRzPj2JYzUOrV8E5W1fPZmfCSgMvJEtwmMbMXMb7sIUPMBh3yBcXQQU=
=yPnD
-----END PGP SIGNATURE-----

Attachment: xsa21.patch
Description: Binary data

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
http://lists.xen.org/xen-devel