Description of the problem: Internal data of the emulator for MMIO operations may, under certain rare conditions, at the end of one emulation cycle be left in a state affecting a subsequent emulation such that this second emulation would fail, causing an exception to be reported to the guest kernel where none is expected. Guest mode unprivileged (user) code, which has been granted the privilege to access MMIO regions, may leverage that access to crash the whole guest. Only HVM guests exposing MMIO ranges to unprivileged (user) mode are vulnerable to this issue. PV guests are not. References: http://seclists.org/oss-sec/2012/q3/119 Acknowledgements: Red Hat would like to thank the Xen for reporting this issue.
Statement: Not vulnerable. The versions of the Linux kernel as shipped with Red Hat Enterprise Linux 5, 6, and Red Hat Enterprise MRG are not affected. The versions of the kernel-xen packages as shipped with Red Hat Enterprise Linux 5 are not affected as they implement a different MMIO emulation mechanism.
Created attachment 600554 [details] Xen Security Advisory #10
RHEL is not affected, MMIO is handled in a simpler way.
Created xen tracking bugs for this issue Affects: fedora-all [bug 843766]
xen-4.1.2-24.fc17 has been pushed to the Fedora 17 stable repository. If problems still persist, please make note of it in this bug report.
xen-4.1.2-9.fc16 has been pushed to the Fedora 16 stable repository. If problems still persist, please make note of it in this bug report.