CVE-2011-1166: Input Validation

Q: What is the severity of CVE-2011-1166?

CVE-2011-1166 is classified as a high severity vulnerability due to its potential to cause a denial of service by crashing the host.

Q: How do I fix CVE-2011-1166?

To mitigate CVE-2011-1166, upgrade your Xen hypervisor to version 4.0.2 or later, which addresses this vulnerability.

Q: What types of systems are affected by CVE-2011-1166?

CVE-2011-1166 primarily affects local 64-bit paravirtualized (PV) Xen guests on vulnerable versions of the Xen hypervisor.

Q: Can CVE-2011-1166 lead to data loss?

While CVE-2011-1166 mainly causes a host crash, it can lead to service disruption that may indirectly result in data loss.

Q: Is CVE-2011-1166 still a concern for current Xen deployments?

CVE-2011-1166 is not a concern for current Xen deployments using versions after 4.0.2, as the vulnerability has been addressed.

Published Jan 7, 2014

Updated

Xen, possibly before 4.0.2, allows local 64-bit PV guests to cause a denial of service (host crash) by specifying user mode execution without user-mode pagetables.

Affected Software

19 affected components

XEN Xen=3.2.0

XEN Xen=3.2.1

XEN Xen=3.0.4

XEN Xen=3.4.0

XEN Xen=3.3.2

XEN Xen=3.2.2

XEN Xen=3.4.4

XEN Xen=4.0.0

XEN Xen=3.4.3

XEN Xen=3.0.3

XEN Xen<=4.0.1

XEN Xen=3.2.3

XEN Xen=3.3.1

XEN Xen=3.0.2

XEN Xen=3.4.2

XEN Xen=3.4.1

XEN Xen=3.1.4

XEN Xen=3.3.0

XEN Xen=3.1.3

Remediation

Patch Available

http://wiki.xen.org/wiki/Security_Announcements#XSA-1_Host_crash_due_to_failure_to_correctly_validate_PV_kernel_execution_state.

Event History

Jan 7, 2014

CVE Published

via MITRE·07:00 PM

Data Sourced

via MITRE·07:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2011-1166?

CVE-2011-1166 is classified as a high severity vulnerability due to its potential to cause a denial of service by crashing the host.

How do I fix CVE-2011-1166?