Bug 1226290 (CVE-2015-4163, xsa134) - CVE-2015-4163 xen: GNTTABOP_swap_grant_ref operation misbehavior (xsa-134)
Summary: CVE-2015-4163 xen: GNTTABOP_swap_grant_ref operation misbehavior (xsa-134)
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2015-4163, xsa134
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks: 1226292
TreeView+ depends on / blocked
 
Reported: 2015-05-29 11:33 UTC by Martin Prpič
Modified: 2023-05-12 09:13 UTC (History)
10 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2015-05-29 12:15:32 UTC
Embargoed:


Attachments (Terms of Use)
xsa134.patch (745 bytes, text/plain)
2015-05-29 12:09 UTC, Martin Prpič
no flags Details

Description Martin Prpič 2015-05-29 11:33:30 UTC
ISSUE DESCRIPTION
=================

With the introduction of version 2 grant table operations, a version check became necessary for most grant table related hypercalls. The GNTTABOP_swap_grant_ref call was lacking such a check. As a result, the subsequent code behaved as if version 2 was in use, when a guest issued this hypercall without a prior GNTTABOP_setup_table or GNTTABOP_set_version.

The effect is a possible NULL pointer dereferences. However, this cannot be exploited to elevate privileges of the attacking domain, as the maximum memory address that can be wrongly accessed this way is bounded to far below the start of hypervisor memory.

IMPACT
======

Malicious or buggy guest domain kernels can mount a denial of service attack which, if successful, can affect the whole system.


Acknowledgements:

Red Hat would like to thank the Xen project for reporting this issue.

Comment 1 Martin Prpič 2015-05-29 12:09:32 UTC
Created attachment 1032041 [details]
xsa134.patch

Comment 3 Petr Matousek 2015-05-29 12:15:32 UTC
Statement:

Not vulnerable.

This issue did not affect the versions of the kernel-xen package as shipped with Red Hat Enterprise Linux 5.


Note You need to log in before you can comment on or make changes to this bug.