Bug 696927 (CVE-2011-1583, CVE-2011-3262) - CVE-2011-1583 CVE-2011-3262 xen: insufficiencies in pv kernel image validation
Summary: CVE-2011-1583 CVE-2011-3262 xen: insufficiencies in pv kernel image validation
Alias: CVE-2011-1583, CVE-2011-3262
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
Depends On: 696938 696939
TreeView+ depends on / blocked
Reported: 2011-04-15 10:37 UTC by Petr Matousek
Modified: 2021-02-24 15:35 UTC (History)
7 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Last Closed: 2012-01-30 12:51:01 UTC

Attachments (Terms of Use)

System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2011:0496 0 normal SHIPPED_LIVE Important: xen security update 2011-05-09 15:50:50 UTC

Description Petr Matousek 2011-04-15 10:37:25 UTC
It has been found that xc_try_bzip2_decode() and xc_try_lzma_decode() decode routines did not properly check for possible buffer size overflow in the decoding loop. Specially crafted kernel image file could be created that would trigger allocation of a small buffer resulting in buffer overflow with user supplied data.

Additionally, several integer overflows and lack of error/range checking that could result in the loader reading its own address space or could lead to an infinite loop have been found.

A privileged DomU user could use these flaws to cause denial of service or, possibly, execute arbitrary code in Dom0.

Only management domains with 32-bit userland are vulnerable.

Comment 11 Laszlo Ersek 2011-04-22 08:44:55 UTC
Created attachment 494129 [details]
5.7 backport of Xen Unstable upstream patch

Comment 19 Petr Matousek 2011-05-09 10:56:45 UTC

This issue did not affect the versions of the Xen package as shipped with Red Hat Enterprise Linux 4 and 6. This has been addressed in Red Hat Enterprise Linux 5 via https://rhn.redhat.com/errata/RHSA-2011-0496.html.

Comment 20 errata-xmlrpc 2011-05-09 15:50:56 UTC
This issue has been addressed in following products:

  Red Hat Enterprise Linux 5

Via RHSA-2011:0496 https://rhn.redhat.com/errata/RHSA-2011-0496.html

Note You need to log in before you can comment on or make changes to this bug.