high
8.8
CWE
682
Advisory Published
CVE Published
Updated

CVE-2017-12134

First published: Wed Aug 02 2017(Updated: )

ISSUE DESCRIPTION ================= The block layer in Linux may choose to merge adjacent block IO requests. When Linux is running as a Xen guest, the default merging algorithm is replaced with a Xen-specific one. When Linux is running as an x86 PV guest, some BIO's are erroneously merged, corrupting the data stream to/from the block device. This can result in incorrect access to an uncontrolled adjacent frame. IMPACT ====== A buggy or malicious guest can cause Linux to read or write incorrect memory when processing a block stream. This could leak information from other guests in the system or from Xen itself, or be used to DoS or escalate privilege within the system. VULNERABLE SYSTEMS ================== All x86 Xen systems using pvops Linux in a backend role (either as dom0, or as a disk device driver domain) are affected. This includes upstream Linux versions 2.6.37 and later. Systems using the older classic-linux fork are not affected. All PV x86 domains doing block IO on behalf of a guest, including dom0 and any PV driver domains, are vulnerable. (Any HVM driver domains running are not vulnerable.) This includes Xen vbd backends such as blkback, but also direct IO performed for the guest via eg qemu. ARM systems are not affected. The vulnerability is only exposed if the underlying block device has request merging enabled. See Mitigation. The vulnerability is only exposed to configurations which use grant mapping as a transport mechanism for the block data. Configurations which use exclusively grant copy are not vulnerable. MITIGATION ========== Disable bio merges on all relevant underlying backend block devices. For example, echo 2 &gt; /sys/block/nvme0n1/queue/nomerges External References: <a href="http://xenbits.xen.org/xsa/advisory-229.html">http://xenbits.xen.org/xsa/advisory-229.html</a>

Credit: cve@mitre.org cve@mitre.org

Affected SoftwareAffected VersionHow to fix
Xen Xen
Citrix XenServer=6.0.2
Citrix XenServer=6.2.0
Citrix XenServer=6.5
Citrix XenServer=7.0
Citrix XenServer=7.1
Citrix XenServer=7.2
debian/linux
5.10.223-1
5.10.226-1
6.1.115-1
6.1.112-1
6.11.7-1
6.11.9-1

Remedy

http://xenbits.xen.org/xsa/advisory-229.html

Remedy

https://bugzilla.redhat.com/show_bug.cgi?id=1477656

Remedy

https://support.citrix.com/article/CTX225941

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Frequently Asked Questions

  • What is the vulnerability identifier for this vulnerability?

    The vulnerability identifier for this vulnerability is CVE-2017-12134.

  • What is the severity of CVE-2017-12134?

    The severity of CVE-2017-12134 is medium.

  • How does CVE-2017-12134 affect the affected software?

    CVE-2017-12134 might allow local OS guest users to corrupt block device data streams and gain sensitive memory information, cause a denial of service, or gain host OS privileges.

  • What is the recommended fix for CVE-2017-12134?

    The recommended fix for CVE-2017-12134 is to update to the specified versions of the affected software.

  • Where can I find more information about CVE-2017-12134?

    You can find more information about CVE-2017-12134 in the references provided: [link1], [link2], [link3].

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2024 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203