CVE-2011-1780: Input Validation
First published: Fri May 06 2011(Updated: )
A bug was found in the way Xen handles instruction emulation during VM exits. Malicious guest user space process running in SMP guest can trick the emulator into reading different instruction than the one that caused the VM exit. To do so it should run legitimate instruction that causes VM exit in one thread and replace this instruction to another one from second thread. An unprivileged guest user can potentially use this flaw to crash the host. ------------------------------------------------------------- Original name: xen: svvp Disable Enable With IO will reboot the host which CPU is AMD Description of problem: svvp Disable Enable With IO will reboot the host svvp "Disable Enable with IO"'s child job "Driver Verifier -Enable"'s child job "Reboot System Under Test" should only reboot the guest , but when the guest prepare to enter the desktop after reboot , the host (SUT) will reboot . Version-Release number of selected component (if applicable): xen-3.0.3-129.el5 kernel-xen-2.6.18-257.el5 xenpv-win-1.3.4-9.el5 How reproducible: 100% Steps to Reproduce: 1. run the Disable Enable With IO 2. 3. Actual results: host will reboot Expected results: host should not reboot Additional info: Sometimes the guest even do not run the disable and enable jobs ,the host will reboot when I reboot the guest which run the disable and enable job once.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Xen Xen | =3.0.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- collector/nvd-historical
- collector/nvd-index
- agent/references
- agent/type
- agent/softwarecombine
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/author
- agent/last-modified-date
- agent/weakness
- agent/description
- agent/event
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2011-1780
- agent/tags
- agent/trending
- vendor/xen
- canonical/xen xen
- version/xen xen/3.0.3