Bug 1823925 (CVE-2020-11743) - CVE-2020-11743 xen: bad error path in GNTTABOP_map_grant (XSA-316)
Summary: CVE-2020-11743 xen: bad error path in GNTTABOP_map_grant (XSA-316)
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2020-11743
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1823926
Blocks: 1823927
TreeView+ depends on / blocked
 
Reported: 2020-04-14 19:44 UTC by Guilherme de Almeida Suckevicz
Modified: 2020-08-24 16:30 UTC (History)
22 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in Xen through versions 4.13.x. Grant table operations are expected to return 0 for success and a negative number for errors. Some misplaced brackets cause one error path to return 1 instead of a negative value. The grant table code in Linux treats this condition as success, and proceeds with incorrectly initialized state. A buggy or malicious guest can construct its grant table in such a way that, when a backend domain tries to map a grant, it hits the incorrect error path which will crash a Linux based dom0 or backend domain. The highest threat from this vulnerability is to data confidentiality.
Clone Of:
Environment:
Last Closed: 2020-04-16 15:42:36 UTC


Attachments (Terms of Use)

Description Guilherme de Almeida Suckevicz 2020-04-14 19:44:53 UTC
An issue was discovered in Xen through 4.13.x, allowing guest OS users to cause a denial of service because of a bad error path in GNTTABOP_map_grant. Grant table operations are expected to return 0 for success, and a negative number for errors. Some misplaced brackets cause one error path to return 1 instead of a negative value. The grant table code in Linux treats this condition as success, and proceeds with incorrectly initialised state. A buggy or malicious guest can construct its grant table in such a way that, when a backend domain tries to map a grant, it hits the incorrect error path. This will crash a Linux based dom0 or backend domain.

Reference:
https://xenbits.xen.org/xsa/advisory-316.html

Comment 1 Guilherme de Almeida Suckevicz 2020-04-14 19:45:11 UTC
Created xen tracking bugs for this issue:

Affects: fedora-all [bug 1823926]


Note You need to log in before you can comment on or make changes to this bug.