CVE-2011-2901: Medium severity xen xapi vulnerability
Off-by-one error in the addrok macro in Xen 3.3 and earlier allows local 64 bit PV guest administrators to cause a denial of service (host crash) via unspecified hypercalls that ignore virtual-address bits.
Other sources
The x8664 addrok() macro intends to ensure that the checked address is either in the positive half of the 48-bit virtual address space, or above the Xen-reserved area. However, the current shift count is off-by-one, allowing full access to the "negative half" too, via certain hypercalls which ignore virtual-address bits [63:48].
As a result, a malicious guest administrator on a vulnerable system is able to crash the host.
There are no known further exploits but these have not been ruled out.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2011-2901?
CVE-2011-2901 has a high severity as it can lead to a denial of service through a host crash.
How do I fix CVE-2011-2901?
To fix CVE-2011-2901, upgrade to a version of Xen later than 3.3.0, as the vulnerability is addressed in more recent updates.
Which versions of Xen are affected by CVE-2011-2901?
CVE-2011-2901 affects Xen versions 3.3.0 and earlier, including specific versions such as 3.0.2, 3.0.3, 3.0.4, 3.1.3, 3.1.4, 3.2.0, 3.2.1, 3.2.2, and 3.2.3.
What type of attack can exploit CVE-2011-2901?
CVE-2011-2901 can be exploited through unspecified hypercalls that manipulate virtual address bits.
Who can exploit CVE-2011-2901?
Local 64-bit paravirtual (PV) guest administrators can exploit CVE-2011-2901 to cause a denial of service.