CVE-2009-3525: High severity xen xapi vulnerability
pyGrub bootloader used to boot Xen para-virtualized guests did not have support for password command as supported by normal grub. If this option was used in grub.conf, it did not restrict users with access to para-virtualized guest's console from booting guest or changing kernel boot parameters without providing configured password. This could allow user with access to VMs console to get root privileges on the guest's operating system.
Upstream patches: ----------------- http://xenbits.xensource.com/xen-unstable.hg?rev/8f783adc0ee3 http://xenbits.xensource.com/staging/xen-unstable.hg?rev/a28c9c2fa8de http://xenbits.xensource.com/xen-unstable.hg?rev/e513d565c8f1 http://xenbits.xensource.com/xen-unstable.hg?rev/67f1b8b32585 http://xenbits.xensource.com/xen-unstable.hg?rev/168f0cfeded0
CVE Request: ------------ http://www.openwall.com/lists/oss-security/2009/09/25/1
Other sources
The pyGrub boot loader in Xen 3.0.3, 3.3.0, and Xen-3.3.1 does not support the password option in grub.conf for para-virtualized guests, which allows attackers with access to the para-virtualized guest console to boot the guest or modify the guest's kernel boot parameters without providing the expected password.
— MITRE
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2009-3525?
CVE-2009-3525 is considered a medium-severity vulnerability due to unauthorized access to the grub command line.
How do I fix CVE-2009-3525?
To fix CVE-2009-3525, upgrade to a version of Xen that implements password protection for para-virtualized guest consoles.
Which software versions are affected by CVE-2009-3525?
CVE-2009-3525 affects Xen versions 3.0.3, 3.3.0, and 3.3.1.
What is the impact of CVE-2009-3525 on security?
The impact of CVE-2009-3525 allows unauthorized users to modify the kernel boot parameters or boot the guest without restriction.
Is there a workaround for CVE-2009-3525?
Disabling access to the para-virtualized guest's console can serve as a temporary workaround for CVE-2009-3525 until a proper update is applied.