Bug 851202 - (CVE-2012-3516) CVE-2012-3516 kernel: xen: grant table entry swaps have inadequate bounds checking
CVE-2012-3516 kernel: xen: grant table entry swaps have inadequate bounds che...
Status: CLOSED NOTABUG
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
high Severity high
: ---
: ---
Assigned To: Red Hat Product Security
impact=important,public=20120905,repo...
: Security
Depends On: 854595
Blocks: 851204
  Show dependency treegraph
 
Reported: 2012-08-23 09:37 EDT by Petr Matousek
Modified: 2015-08-24 12:05 EDT (History)
7 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2015-08-24 12:05:26 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Petr Matousek 2012-08-23 09:37:46 EDT
The grant table hypercall's GNTTABOP_swap_grant_ref sub-operation does not perform adequate checks on the input grant references.

A malicious guest kernel or administrator can crash the host.

It may be possible for an attacker to swap a valid grant reference, which they control, with an invalid one allowing them to write abitrary values to hypervisor memory. This could potentially lead to a
privilege escalation.

Acknowledgements:

Red Hat would like to thank the Xen project for reporting this issue.
Comment 3 Petr Matousek 2012-08-23 09:40:48 EDT
Statement:

Not vulnerable.

This issue did not affect the versions of the kernel-xen package as shipped with Red Hat Enterprise Linux 5.

This issue did not affect Red Hat Enterprise Linux 6 and Red Hat Enterprise MRG as we did not have support for Xen hypervisor.
Comment 4 Petr Matousek 2012-09-05 07:56:37 EDT
Now public via:

http://seclists.org/oss-sec/2012/q3/382
Comment 5 Petr Matousek 2012-09-05 08:05:06 EDT
Created xen tracking bugs for this issue

Affects: fedora-all [bug 854595]

Note You need to log in before you can comment on or make changes to this bug.