CVE-2011-1780: Input Validation
A bug was found in the way Xen handles instruction emulation during VM exits. Malicious guest user space process running in SMP guest can trick the emulator into reading different instruction than the one that caused the VM exit. To do so it should run legitimate instruction that causes VM exit in one thread and replace this instruction to another one from second thread. An unprivileged guest user can potentially use this flaw to crash the host.
-------------------------------------------------------------
Original name: xen: svvp Disable Enable With IO will reboot the host which CPU is AMD
Description of problem: svvp Disable Enable With IO will reboot the host
svvp "Disable Enable with IO"'s child job "Driver Verifier -Enable"'s child job "Reboot System Under Test" should only reboot the guest , but when the guest prepare to enter the desktop after reboot , the host (SUT) will reboot .
Version-Release number of selected component (if applicable): xen-3.0.3-129.el5 kernel-xen-2.6.18-257.el5 xenpv-win-1.3.4-9.el5
How reproducible: 100%
Steps to Reproduce: 1. run the Disable Enable With IO 2. 3. Actual results: host will reboot
Expected results: host should not reboot
Additional info: Sometimes the guest even do not run the disable and enable jobs ,the host will reboot when I reboot the guest which run the disable and enable job once.
Other sources
The instruction emulation in Xen 3.0.3 allows local SMP guest users to cause a denial of service (host crash) by replacing the instruction that causes the VM to exit in one thread with a different instruction in a different thread.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2011-1780?
CVE-2011-1780 has a moderate severity level due to its potential to allow privilege escalation in the context of the Xen hypervisor.
How do I fix CVE-2011-1780?
To fix CVE-2011-1780, you should upgrade to a patched version of the Xen hypervisor that addresses this vulnerability.
Which versions of Xen are affected by CVE-2011-1780?
CVE-2011-1780 specifically affects Xen version 3.0.3.
What type of vulnerability is CVE-2011-1780?
CVE-2011-1780 is a flaw in instruction emulation during VM exits in the Xen hypervisor.
Who can exploit CVE-2011-1780?
CVE-2011-1780 can be exploited by a malicious guest user space process running in a symmetric multiprocessing (SMP) guest.