CVE-2013-0190: Input Validation
A flaw was found in the way xenfailsafecallback() handled failed iret, which causes the stack pointer to be wrong when entering the iretexc error path. An unprivileged local guest user in the 32-bit PV Xen domain could use this flaw to crash the guest.
References: http://www.openwall.com/lists/oss-security/2013/01/16/6
Acknowledgements:
Red Hat would like to thank the Andrew Cooper of Citrix for reporting this issue.
Other sources
The xenfailsafecallback function in Xen for the Linux kernel 2.6.23 and other versions, when running a 32-bit PVOPS guest, allows local users to cause a denial of service (guest crash) by triggering an iret fault, leading to use of an incorrect stack pointer and stack corruption.
— Launchpad
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2013-0190?
CVE-2013-0190 is considered to have a medium severity due to its potential to crash a guest operating system.
How do I fix CVE-2013-0190?
To fix CVE-2013-0190, update to the latest versions of the Linux kernel that are patched for this vulnerability.
Which software versions are affected by CVE-2013-0190?
CVE-2013-0190 affects Linux kernel versions up to and including 2.6.23 and specific Debian Linux versions.
Can CVE-2013-0190 be exploited remotely?
CVE-2013-0190 cannot be exploited remotely as it requires an unprivileged local guest user.
What type of vulnerability is CVE-2013-0190?
CVE-2013-0190 is a stack pointer vulnerability that affects the handling of failed iret in Xen domains.