Bug 1088243 (CVE-2014-3124)

Summary: CVE-2014-3124 xen: hypervisor: HVMOP_set_mem_type allows invalid P2M entries to be created (XSA-92)
Product: [Other] Security Response Reporter: Petr Matousek <pmatouse>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED NOTABUG QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: drjones, imammedo, pbonzini, rkrcmar, security-response-team
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2014-04-16 10:11:07 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1093315    
Bug Blocks: 1088255    

Description Petr Matousek 2014-04-16 09:59:21 UTC 
The implementation in Xen of the HVMOP_set_mem_type HVM control
operations attempts to exclude transitioning a page from an
inappropriate memory type.  However, only an inadequate subset of
memory types is excluded.

There are certain other types that don't correspond to a particular
valid page, whose page table translation can be inappropriately
changed (by HVMOP_set_mem_type) from not-present (due to the lack of
valid memory page) to present.  If this occurs, an invalid translation
will be established.

A malicious administrator of a domain privileged with regard to an
HVM guest can cause Xen to crash leading to a Denial of Service.

Arbitrary code execution, and therefore privilege escalation, cannot
be entirely excluded: On a system with a RAM page present immediately
below the 52-bit address boundary, this would be possible.  However,
we are not aware of any systems with such a memory layout.

Acknowledgements:

Red Hat would like to thank the Xen project for reporting this issue.
Comment 3 Petr Matousek 2014-04-16 10:11:07 UTC 
Statement:

Not vulnerable.

This issue did not affect the versions of the kernel-xen package as shipped with Red Hat Enterprise Linux 5.
Comment 4 Petr Matousek 2014-05-01 11:01:34 UTC 
Created xen tracking bugs for this issue:

Affects: fedora-all [bug 1093315]