Internet threat level: 1
Home→Descriptions→SA51397
Xen Multiple Vulnerabilities
| Secunia ID | |
| CVE-ID |
CVE-2012-5510, CVE-2012-5511, CVE-2012-5512, CVE-2012-5513, CVE-2012-5514, CVE-2012-5515, CVE-2012-5525, CVE-2012-6333 |
| Release Date |
04 Dec 2012 |
| Last Change |
18 Jan 2013 |
| Criticality | |
| Solution Status |
Vendor Patch |
| Software |
Xen 3.x |
| Where | |
| Impact |
DoS (Denial of Service)This includes vulnerabilities ranging from excessive resource consumption (e.g. causing a system to use a lot of memory) to crashing an application or an entire system. Privilege escalationThis covers vulnerabilities where a user is able to conduct certain tasks with the privileges of other users or administrative users. This typically includes cases where a local user on a client or server system can gain access to the administrator or root account thus taking full control of the system. |
| Description |
Multiple vulnerabilities have been reported in Xen, which can be exploited by malicious, local users in a guest virtual machine to cause a DoS (Denial of Service) and potentially gain escalated privileges. 1) An error when downgrading a grant table version of a guest can be exploited to cause a hypervisor crash. 2) An error when handling certain HVM control operations can be exploited to consume physical CPU resources. 3) An array-indexing error in the "HVMOP_set_mem_access" operation handler can be exploited to cause a crash. 4) An error in the "XENMEM_exchange" handler may result in guest provided addresses to be included in the hypervisor's reserved range. 5) An error in the "guest_physmap_mark_populate_on_demand()" function when checking subject GFNs can be exploited to cause a hang. 6) An error when handling "extent_order" values for "XENMEM_decrease_reservation", "XENMEM_populate_physmap", and "XENMEM_exchange" can be exploited to cause a hang. 7) An error in the "get_page_from_gfn()" function when handling an input GFN can be exploited to reference memory outside of the frame table. Please see the vendor's advisory for a list of affected versions. |
| Solution |
Apply patches (please see the vendor's advisory for details). |
| Reported by |
Reported by the vendor. |
| Original Advisory |
Xen (XSA-26, XSA-27, XSA-28, XSA-29, XSA-30, XSA-31, XSA-32): |
© 1997-2013 Kaspersky Lab ZAO. All Rights Reserved.
Industry-leading Antivirus Software.
Registered trademarks and service marks are the property of their respective owners.
The authors' opinions do not necessarily reflect the official positions of Kaspersky Lab.