Re: CVE Request: XEN local denial of service

[Eugene Teo <eugene () redhat com>]

Hi Steve,

Steven M. Christey wrote:
> More specific information on Xen's affected versions would be appreciated.
> I made a guess based on the version that was released a few days after the
> patch.

I can't seem to find the fix in xen-3.4.0-xen.tar.gz but I found the
patch in the linux-2.6.18-xen.hg repository:
http://xenbits.xensource.com/linux-2.6.18-xen.hg?rev/9b9454800544

In http://xenbits.xensource.com, this tree is said to be the pre-release
of the next 3.3 version of Xen (which doesn't sound right).

> ======================================================
> Name: CVE-2009-1758
> Status: Candidate
> URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1758
> Reference: MLIST:[Xen-devel] 20090513 [PATCH] linux/i386: hypervisor_callback adjustments
> Reference: URL:http://lists.xensource.com/archives/html/xen-devel/2009-05/msg00561.html
> Reference: MLIST:[oss-security] 20090514 CVE Request: XEN local denial of service
> Reference: URL:http://www.openwall.com/lists/oss-security/2009/05/14/2
>
> The hypervisor_callback function in Xen, possibly before 3.4.0, as
> applied to the Linux kernel 2.6.30-rc4, 2.6.18, and probably other
> versions allows guest user applications to cause a denial of service
> (kernel oops) of the guest OS by triggering a segmentation fault in
> "certain address ranges."

This affects a x86 32-bit Xen guest. If a 32-bit application tried to
access a memory location between the scrit and ecrit symbols in the
kernel, instead of receiving a SEGV it could instead crash the kernel.
This happens because of insufficient checking in the hypervisor_callback
path, where it was forgetting to check the CS during entry.

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2009-1758

Thanks, Eugene