Bug 821676 (CVE-2012-2625)

Summary:	CVE-2012-2625 xen: pv bootloader doesn't check the size of the bzip2 or lzma compressed kernel
Product:	[Other] Security Response	Reporter:	Petr Matousek <pmatouse>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	drjones, imammedo, lersek, mrezanin, pbonzini, security-response-team, tburke, xen-maint
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2013-08-24 13:45:45 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	818412, 821704, 821705
Bug Blocks:	821701

Description Petr Matousek 2012-05-15 10:36:33 UTC

The pv bootloader doesn't check the size of a bzip2 or lzma compressed kernel image.  Denial of service can be caused by padding a large file at the end of the kernel image, which can be used by a malicious domU root to cause OOM conditions on the host.

Acknowledgements:

Red Hat would like to thank Xinli Niu for reporting this issue.

Comment 3 Eugene Teo (Security Response) 2012-05-16 01:43:16 UTC

http://bugzilla.xensource.com/bugzilla/show_bug.cgi?id=1817#c4
This has been assigned CVE-2012-2625 by MITRE.

Comment 4 Eugene Teo (Security Response) 2012-05-16 01:44:32 UTC

This is public, http://bugzilla.xensource.com/bugzilla/show_bug.cgi?id=1817.

Comment 5 Petr Matousek 2012-07-10 13:49:21 UTC

Upstream fix:

http://xenbits.xensource.com/hg/xen-unstable.hg/rev/60f09d1ab1fe

Comment 6 errata-xmlrpc 2012-07-31 18:45:50 UTC

This issue has been addressed in following products:

  Red Hat Enterprise Linux 5

Via RHSA-2012:1130 https://rhn.redhat.com/errata/RHSA-2012-1130.html