CVE-2008-1943: Buffer Overflow
Buffer overflow in the backend of XenSource Xen Para Virtualized Frame Buffer (PVFB) 3.0 through 3.1.2 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a crafted description of a shared framebuffer.
Other sources
Description of problem: The PVFB backend is a user space program running as root in dom0. A buggy or malicious frontend can describe its shared framebuffer to it in a way that makes it map an arbitrary amount of guest memory, malloc an arbitrarily large internal buffer, or copy arbitrary memory to that buffer. A domU running a malicious frontend can abuse the former two for a denial of service attack against dom0. It can abuse all three to terminate or crash the backend. If there's anything in the backend's address space that gets tickled the wrong way by being read, the last one is more serious, but I'm not aware of anything like that.
Version-Release number of selected component (if applicable): I believe all versions are vulnerable to the first two abuses, and all versions since 3.0.3-45.el5 are additionally vulnerable to the third one.
How reproducible: Haven't tried, should be 100%.
Steps to Reproduce: I can prepare a malicious frontend if necessary.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2008-1943?
CVE-2008-1943 has been classified with a moderate severity due to the potential for local denial of service and arbitrary code execution.
How do I fix CVE-2008-1943?
To mitigate CVE-2008-1943, upgrade to the patched version 0:3.0.3-41.el5_1.5 of the xen package.
Which software versions are affected by CVE-2008-1943?
CVE-2008-1943 affects XenSource Xen Para Virtualized Frame Buffer (PVFB) versions 3.0 through 3.1.2.
Can CVE-2008-1943 lead to remote exploits?
CVE-2008-1943 primarily allows local users to exploit the vulnerability, which could potentially lead to remote implications if exploited by a local user.
Is there a workaround for CVE-2008-1943?
Currently, the recommended action to address CVE-2008-1943 is to apply the available updates, as no specific workaround has been provided.