oss-security - Re: CVE Request: XEN local denial of service

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <4A1665FB.6070506@redhat.com>
Date: Fri, 22 May 2009 16:44:43 +0800
From: Eugene Teo <eugene@...hat.com>
To: oss-security@...ts.openwall.com
CC: "Steven M. Christey" <coley@...us.mitre.org>
Subject: Re: CVE Request: XEN local denial of service

Hi Steve,

Steven M. Christey wrote:
> More specific information on Xen's affected versions would be appreciated.
> I made a guess based on the version that was released a few days after the
> patch.

I can't seem to find the fix in xen-3.4.0-xen.tar.gz but I found the
patch in the linux-2.6.18-xen.hg repository:
http://xenbits.xensource.com/linux-2.6.18-xen.hg?rev/9b9454800544

In http://xenbits.xensource.com, this tree is said to be the pre-release
of the next 3.3 version of Xen (which doesn't sound right).

> ======================================================
> Name: CVE-2009-1758
> Status: Candidate
> URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1758
> Reference: MLIST:[Xen-devel] 20090513 [PATCH] linux/i386: hypervisor_callback adjustments
> Reference: URL:http://lists.xensource.com/archives/html/xen-devel/2009-05/msg00561.html
> Reference: MLIST:[oss-security] 20090514 CVE Request: XEN local denial of service
> Reference: URL:http://www.openwall.com/lists/oss-security/2009/05/14/2
> 
> The hypervisor_callback function in Xen, possibly before 3.4.0, as
> applied to the Linux kernel 2.6.30-rc4, 2.6.18, and probably other
> versions allows guest user applications to cause a denial of service
> (kernel oops) of the guest OS by triggering a segmentation fault in
> "certain address ranges."

This affects a x86 32-bit Xen guest. If a 32-bit application tried to
access a memory location between the scrit and ecrit symbols in the
kernel, instead of receiving a SEGV it could instead crash the kernel.
This happens because of insufficient checking in the hypervisor_callback
path, where it was forgetting to check the CS during entry.

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2009-1758

Thanks, Eugene

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.