CVE-2013-4553: Buffer Overflow

Published Dec 24, 2013

Updated

The XENDOMCTLgetmemlist hypercall in Xen 3.4.x through 4.3.x (possibly 4.3.1) does not always obtain the pagealloclock and mmrwlock in the same order, which allows local guest administrators to cause a denial of service (host deadlock).

Affected Software

23 affected components

XEN Xen=3.4.0

XEN Xen=3.4.1

XEN Xen=3.4.2

XEN Xen=3.4.3

XEN Xen=3.4.4

XEN Xen=4.0.0

XEN Xen=4.0.1

XEN Xen=4.0.2

XEN Xen=4.0.3

XEN Xen=4.0.4

XEN Xen=4.1.0

XEN Xen=4.1.1

XEN Xen=4.1.2

XEN Xen=4.1.3

XEN Xen=4.1.4

XEN Xen=4.1.5

XEN Xen=4.1.6.1

XEN Xen=4.2.0

XEN Xen=4.2.1

XEN Xen=4.2.2

XEN Xen=4.2.3

XEN Xen=4.3.0

XEN Xen=4.3.1

Event History

Dec 24, 2013

CVE Published

via MITRE·07:00 PM

Data Sourced

via MITRE·07:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2013-4553?

CVE-2013-4553 has a high severity rating due to its potential to cause denial of service through host deadlock.

How do I fix CVE-2013-4553?

To fix CVE-2013-4553, upgrade to the latest version of Xen that includes the security patch addressing this vulnerability.

Which versions of Xen are affected by CVE-2013-4553?

CVE-2013-4553 affects Xen versions 3.4.0 through 4.3.1.

What type of attack does CVE-2013-4553 enable?

CVE-2013-4553 enables local guest administrators to initiate a denial of service attack that could lead to host deadlock.

Is CVE-2013-4553 related to locking mechanisms in Xen?

Yes, CVE-2013-4553 is related to the incorrect ordering of the page_alloc_lock and mm_rwlock, leading to potential deadlocks.