CVE-2008-1952: Buffer Overflow
Description of problem:
The recent fix to validate the frontend's frame buffer description neglected to limit the frame buffer size correctly. This lets a malicious frontend make the backend attempt to map an arbitrary amount of guest memory, which could be useful for a denial of service attack against dom0.
Proposed upstream patch:
http://xenbits.xensource.com/xen-unstable.hg?rev/9044705960cb30cec385bdca7305bcf7db096721
Other sources
The backend for XenSource Xen Para Virtualized Frame Buffer (PVFB) in Xen ioemu does not properly restrict the frame buffer size, which allows attackers to cause a denial of service (crash) by mapping an arbitrary amount of guest memory.
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2008-1952?
CVE-2008-1952 is classified as a denial of service vulnerability which can lead to a system crash.
How do I fix CVE-2008-1952?
To mitigate CVE-2008-1952, update to the version 0:3.0.3-64.el5_2.3 or newer for the affected Xen package.
What products are affected by CVE-2008-1952?
CVE-2008-1952 affects the XenSource Xen Para Virtualized Frame Buffer, specifically the older versions of the Xen package.
What attacks can be performed using CVE-2008-1952?
An attacker can exploit CVE-2008-1952 to map an arbitrary amount of guest memory, causing a denial of service.
Is there a known workaround for CVE-2008-1952?
Currently, the primary recommendation for CVE-2008-1952 is to apply the necessary updates rather than relying on a workaround.