CVE-2010-4238: Null Pointer Dereference
Description of problem: Dom0 crashes when installing GPLPV drivers on Windows 2008 R2 guest.
Xen version: 3.1.2-194.11.3.el5 Dom0 kernel: 2.6.18-194.11.3.el5xen GPLPV: gplpvVista2008x640.11.0.213.msi and older
Redirected to serial console output:
Unable to handle kernel NULL pointer dereference at 0000000000000108 RIP: [<ffffffff8883f03f>] :blkbk:updateblkifstatus+0x21f/0x2ae PGD 0 Oops: 0000 [1] SMP last sysfs file: /class/net/lo/ifindex CPU 2 Modules linked in: tun xfs ocfs2(U) iptMASQUERADE netloop iptablenat ipnat netbk blktap blkbk mptctl mptbase ipmiwatchdog ipmisi(U) ipmidevintf(U) ipmimsghandler(U) autofs4 hidp l2cap bluetooth ocfs2dlmfs(U) ocfs2dlm(U) ocfs2nodemanager(U) configfs lockd sunrpc bonding ipconntracknetbiosns iptREJECT xtstate ipconntrack nfnetlink xtphysdev bridge iptablefilter iptables ip6tREJECT xttcpudp ip6tablefilter ip6tables xtables ipv6 xfrmnalgo cryptoapi be2iscsi ibiser rdmacm ibcm iwcm ibsa ibmad ibcore ibaddr iscsitcp bnx2i(U) cnic(U) cxgb3i cxgb3 libiscsitcp libiscsi2 scsitransportiscsi2 scsitransportiscsi loop dmroundrobin dmmultipath scsidh video backlight sbs powermeter hwmon i2cec i2ccore dellwmi wmi button battery asusacpi ac parportpc lp parport srmod cdrom sg serioraw pcspkr hpilo serialcore bnx2x(U) 8021q dmraid45 dmmessage dmregionhash dmmemcache dmsnapshot dmzero dmmirror dmlog dmmod usbstorage shpchp cciss(U) sdmod scsimod ext3 jbd uhcihcd ohcihcd ehcihcd Pid: 69, comm: xenwatch Tainted: G 2.6.18-194.11.3.el5xen 0000001 RIP: e030:[<ffffffff8883f03f>] [<ffffffff8883f03f>] :blkbk:updateblkifstatus+0x21f/0x2ae RSP: e02b:ffff88003e413df0 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff88003db2f620 RCX: 0000000000000003 RDX: ffffffffff578000 RSI: fffffffffffffffb RDI: 0000000000000000 RBP: ffff880031227b70 R08: 00000000ffffffff R09: 0000000000000020 R10: 00000000ffffffff R11: 0000000000000000 R12: ffff8800087edb40 R13: 0000000000000000 R14: ffff880000e0bcf0 R15: ffffffff8029c1ef FS: 00002b79280d26e0(0000) GS:ffffffff805d2100(0000) knlGS:0000000000000000 CS: e033 DS: 0000 ES: 0000 Process xenwatch (pid: 69, threadinfo ffff88003e412000, task ffff88003e3ea080) Stack: 2e6b6361626b6c62 0000006364682e33 ffff880000000025 ffff8800087edb40 ffff880034383c00 ffff8800087edb40 ffff880034383c00 ffffffff8883f2eb 6669636570736e75 737361202c646569 Call Trace: [<ffffffff8883f2eb>] :blkbk:frontendchanged+0x21d/0x226 [<ffffffff803b9c78>] xenwatchthread+0x0/0x135 [<ffffffff803b90ca>] xenwatchhandlecallback+0x15/0x48 [<ffffffff803b9d94>] xenwatchthread+0x11c/0x135 [<ffffffff8029c407>] autoremovewakefunction+0x0/0x2e [<ffffffff8029c1ef>] keventdcreatekthread+0x0/0xc4 [<ffffffff80233be4>] kthread+0xfe/0x132 [<ffffffff80260b2c>] childrip+0xa/0x12 [<ffffffff8029c1ef>] keventdcreatekthread+0x0/0xc4 [<ffffffff80233ae6>] kthread+0x0/0x132 [<ffffffff80260b22>] childrip+0x0/0x12
Code: 48 8b b8 08 01 00 00 e8 b3 f6 a7 f7 85 c0 89 c6 74 0d 48 8b RIP [<ffffffff8883f03f>] :blkbk:updateblkifstatus+0x21f/0x2ae RSP <ffff88003e413df0> CR2: 0000000000000108 <0>Kernel panic - not syncing: Fatal exception (XEN) Domain 0 crashed: rebooting machine in 5 seconds.
http://bugs.centos.org/bugviewadvancedpage.php?bugid=4517
Acknowledgements:
Red Hat would like to thank Vladymyr Denysov for reporting this issue.
Other sources
The vbdcreate function in Xen 3.1.2, when the Linux kernel 2.6.18 on Red Hat Enterprise Linux (RHEL) 5 is used, allows guest OS users to cause a denial of service (host OS panic) via an attempted access to a virtual CD-ROM device through the blkback driver. NOTE: some of these details are obtained from third party information.
— Debian
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2010-4238?
CVE-2010-4238 is classified as a high severity vulnerability due to its potential to cause system crashes.
How do I fix CVE-2010-4238?
To fix CVE-2010-4238, ensure that you are using an updated version of the GPLPV drivers that is newer than gplpv_Vista2008x64_0.11.0.213.
What systems are affected by CVE-2010-4238?
CVE-2010-4238 affects Xen version 3.1.2 and Windows 2008 R2 guest installations with older GPLPV drivers.
What happens if CVE-2010-4238 is exploited?
Exploitation of CVE-2010-4238 may lead to a crash of the Dom0, compromising the stability of the virtualization environment.
Who should be concerned about CVE-2010-4238?
Administrators using Xen version 3.1.2 with Windows 2008 R2 guests and outdated GPLPV drivers should be concerned about CVE-2010-4238.