Bug 696927 - (CVE-2011-1583, CVE-2011-3262) CVE-2011-1583 CVE-2011-3262 xen: insufficiencies in pv kernel image validation
CVE-2011-1583 CVE-2011-3262 xen: insufficiencies in pv kernel image validation
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
All Linux
high Severity high
: ---
: ---
Assigned To: Red Hat Product Security
: Security
Depends On: 696938 696939
  Show dependency treegraph
Reported: 2011-04-15 06:37 EDT by Petr Matousek
Modified: 2015-08-19 05:09 EDT (History)
7 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2012-01-30 07:51:01 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Petr Matousek 2011-04-15 06:37:25 EDT
It has been found that xc_try_bzip2_decode() and xc_try_lzma_decode() decode routines did not properly check for possible buffer size overflow in the decoding loop. Specially crafted kernel image file could be created that would trigger allocation of a small buffer resulting in buffer overflow with user supplied data.

Additionally, several integer overflows and lack of error/range checking that could result in the loader reading its own address space or could lead to an infinite loop have been found.

A privileged DomU user could use these flaws to cause denial of service or, possibly, execute arbitrary code in Dom0.

Only management domains with 32-bit userland are vulnerable.
Comment 11 Laszlo Ersek 2011-04-22 04:44:55 EDT
Created attachment 494129 [details]
5.7 backport of Xen Unstable upstream patch
Comment 19 Petr Matousek 2011-05-09 06:56:45 EDT

This issue did not affect the versions of the Xen package as shipped with Red Hat Enterprise Linux 4 and 6. This has been addressed in Red Hat Enterprise Linux 5 via https://rhn.redhat.com/errata/RHSA-2011-0496.html.
Comment 20 errata-xmlrpc 2011-05-09 11:50:56 EDT
This issue has been addressed in following products:

  Red Hat Enterprise Linux 5

Via RHSA-2011:0496 https://rhn.redhat.com/errata/RHSA-2011-0496.html

Note You need to log in before you can comment on or make changes to this bug.