CVE-2008-4405: High severity xenserver vulnerability
Description of problem: Every paravirt guest (and some fullvirt guests) have a TTY path associated with them for the text console access to the guest domain. The TTY path is allocated at time of VM creation, and is written into xenstored.
xm console reads the TTY path out of xenstored and opens it to provide admin access to the text console.
The problem is that the TTY path is written into an area of xenstore which is writtable by the guest. So a malicious guest can re-write the TTY path, tricking the host admin into accessing a different TTY than they should.
eg, if you have a guest called 'demo', with domain ID 5, inside the guest you could do
# yum install xen # xenstore-write /local/domain/5/console/tty /i/am/the/evil/guest
Then when the host admin tries to connect to the console later
# xm console rhel5pv xenconsole: Could not open tty /i/am/the/evil/guest': No such file or directory
Not sure yet if this could cause xm console to actually corrupt/overwrite important files, or if its just a inconvenience.
There is a tonne of other info written & read to/from this untrustable area, and some of it is serious
For fullvirt guests, the PID of the QEMU device model is written into the device model at /local/domain/$DOMID/image/device-model-pid
If a malicious guest did
xenstore-write /local/domain/26/image/device-model-pid 1
It is possible that in some circumstances, when a host admin later tries to kill the guest, it would in fact kill 'init' process in the host.
Version-Release number of selected component (if applicable): xen-3.0.3-64.el5
How reproducible: Always
Steps to Reproduce: 1. Inside a guest
#yum install xen # xenstore-write /local/domain/GUEST-DOMID/console/tty /i/am/the/evil/guest
2. On the host
xm console GUEST-NAME
Also various other checks Actual results: xenconsole: Could not open tty /i/am/the/evil/guest': No such file or directory
Expected results: xm console still works, and does not read data from untrusted areas.
Additional info:
Other sources
xend in Xen 3.0.3 does not properly limit the contents of the /local/domain xenstore directory tree, and does not properly restrict a guest VM's write access within this tree, which allows guest OS users to cause a denial of service and possibly have unspecified other impact by writing to (1) console/tty, (2) console/limit, or (3) image/device-model-pid. NOTE: this issue was originally reported as an issue in libvirt 0.3.3 and xenstore, but CVE is considering the core issue to be related to Xen.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2008-4405?
CVE-2008-4405 is considered to have a medium severity rating due to its potential to allow unauthorized access to the console of paravirtualized guests.
How do I fix CVE-2008-4405?
To mitigate CVE-2008-4405, you should upgrade your XenServer to version 3.0.4 or higher.
What software is affected by CVE-2008-4405?
CVE-2008-4405 affects Citrix XenServer version 3.0.3.
What type of vulnerability is CVE-2008-4405?
CVE-2008-4405 is a vulnerability related to unauthorized access to TTY paths associated with virtual machines.
Can CVE-2008-4405 affect both paravirtualized and fully virtualized guests?
Yes, CVE-2008-4405 can affect every paravirtual guest and some full virtualization guests.