CVE-2010-4247: Input Validation
If the frontend pass a bad index of production request, the backend will enter an endless loop and then cause a excessive CPU consumption.
This issue has been fixed in upstream by: changeset: 391:77f831cbb91d user: Keir Fraser <keir.fraser> date: Fri Jan 18 16:52:25 2008 +0000 summary: blkback: Request-processing loop is unbounded and hence requires a http://xenbits.xensource.com/linux-2.6.18-xen.hg?rev/77f831cbb91d
changeset: 392:7070d34f251c user: Keir Fraser <keir.fraser> date: Mon Jan 21 11:43:31 2008 +0000 summary: blkback/blktap: Check for kthreadshouldstop() in inner loop, http://xenbits.xensource.com/linux-2.6.18-xen.hg?rev/7070d34f251c
Version-Release number of selected component (if applicable): 2.6.18-194.el5xen
How reproducible:
Steps to Reproduce: 1. build a guest kernel with the patch attached. 2. run domU with the patched kernel
Actual results: Dom0 got hung.
Expected results: Dom0 shouldn't be impacted by a bad guest.
Other sources
The doblockioop function in (1) drivers/xen/blkback/blkback.c and (2) drivers/xen/blktap/blktap.c in Xen before 3.4.0 for the Linux kernel 2.6.18, and possibly other versions, allows guest OS users to cause a denial of service (infinite loop and CPU consumption) via a large production request index to the blkback or blktap back-end drivers. NOTE: some of these details are obtained from third party information.
— Debian
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2010-4247?
CVE-2010-4247 has been assessed with moderate severity due to its potential for excessive CPU consumption.
How do I fix CVE-2010-4247?
Fix CVE-2010-4247 by updating to the latest version of XenServer that includes the patch from changeset 391:77f831cbb91d.
Which versions of XenServer are affected by CVE-2010-4247?
CVE-2010-4247 affects XenServer versions up to 3.3.2, including specific versions 3.0.2 to 3.3.1.
What causes the issue in CVE-2010-4247?
CVE-2010-4247 is caused by the frontend passing a bad index of production request, resulting in an endless loop.
Is CVE-2010-4247 present in Linux kernel version 2.6.18?
No, the vulnerability CVE-2010-4247 does not affect Linux kernel version 2.6.18.