Bug 1088243 (CVE-2014-3124) - CVE-2014-3124 xen: hypervisor: HVMOP_set_mem_type allows invalid P2M entries to be created (XSA-92)
Summary: CVE-2014-3124 xen: hypervisor: HVMOP_set_mem_type allows invalid P2M entries ...
Alias: CVE-2014-3124
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
Depends On: 1093315
Blocks: 1088255
TreeView+ depends on / blocked
Reported: 2014-04-16 09:59 UTC by Petr Matousek
Modified: 2023-05-12 03:41 UTC (History)
5 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Last Closed: 2014-04-16 10:11:07 UTC

Attachments (Terms of Use)

Description Petr Matousek 2014-04-16 09:59:21 UTC
The implementation in Xen of the HVMOP_set_mem_type HVM control
operations attempts to exclude transitioning a page from an
inappropriate memory type.  However, only an inadequate subset of
memory types is excluded.

There are certain other types that don't correspond to a particular
valid page, whose page table translation can be inappropriately
changed (by HVMOP_set_mem_type) from not-present (due to the lack of
valid memory page) to present.  If this occurs, an invalid translation
will be established.

A malicious administrator of a domain privileged with regard to an
HVM guest can cause Xen to crash leading to a Denial of Service.

Arbitrary code execution, and therefore privilege escalation, cannot
be entirely excluded: On a system with a RAM page present immediately
below the 52-bit address boundary, this would be possible.  However,
we are not aware of any systems with such a memory layout.


Red Hat would like to thank the Xen project for reporting this issue.

Comment 3 Petr Matousek 2014-04-16 10:11:07 UTC

Not vulnerable.

This issue did not affect the versions of the kernel-xen package as shipped with Red Hat Enterprise Linux 5.

Comment 4 Petr Matousek 2014-05-01 11:01:34 UTC
Created xen tracking bugs for this issue:

Affects: fedora-all [bug 1093315]

Note You need to log in before you can comment on or make changes to this bug.