CVE-2017-12136: Race Condition
First published: Wed Aug 02 2017(Updated: )
ISSUE DESCRIPTION ================= The grant table code in Xen has a bespoke semi-lockfree allocator for recording grant mappings ("maptrack" entries). This allocator has a race which allows the free list to be corrupted. Specifically: the code for removing an entry from the free list, prior to use, assumes (without locking) that if inspecting head item shows that it is not the tail, it will continue to not be the tail of the list if it is later found to be still the head and removed with cmpxchg. But the entry might have been removed and replaced, with the result that it might be the tail by then. (The invariants for the semi-lockfree data structure were never formally documented.) Additionally, a stolen entry is put on the free list with an incorrect link field, which will very likely corrupt the list. IMPACT ====== A malicious guest administrator can crash the host, and can probably escalate their privilege to that of the host. VULNERABLE SYSTEMS ================== Xen 4.6 and later are vulnerable. Xen 4.5 and earlier are not vulnerable. MITIGATION ========== There is no mitigation for this vulnerability. External References: <a href="http://xenbits.xen.org/xsa/advisory-228.html">http://xenbits.xen.org/xsa/advisory-228.html</a>
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Xen Xen | =4.6.0 | |
| Xen Xen | =4.6.1 | |
| Xen Xen | =4.6.3 | |
| Xen Xen | =4.6.4 | |
| Xen Xen | =4.6.5 | |
| Xen Xen | =4.6.6 | |
| Xen Xen | =4.7.0 | |
| Xen Xen | =4.7.1 | |
| Xen Xen | =4.7.2 | |
| Xen Xen | =4.7.3 | |
| Xen Xen | =4.8.0 | |
| Xen Xen | =4.8.1 | |
| Xen Xen | =4.9.0 | |
| Citrix XenServer | =6.0.2 | |
| Citrix XenServer | =6.2.0 | |
| Citrix XenServer | =6.5 | |
| Citrix XenServer | =7.0 | |
| Citrix XenServer | =7.1 | |
| Citrix XenServer | =7.2 | |
| Debian Debian Linux | =8.0 | |
| Debian Debian Linux | =9.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://xenbits.xen.org/xsa/advisory-228.html
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1481765
- https://bugzilla.redhat.com/show_bug.cgi?id=1477651
- http://www.debian.org/security/2017/dsa-3969
- http://www.openwall.com/lists/oss-security/2017/08/15/3
- http://www.securityfocus.com/bid/100346
- http://www.securitytracker.com/id/1039175
- https://security.gentoo.org/glsa/201801-14
- https://support.citrix.com/article/CTX225941
- collector/redhat-bugzilla
- alias/CVE-2017-12136
- collector/nvd-index
- agent/weakness
- agent/severity
- agent/references
- agent/author
- agent/type
- agent/description
- agent/tags
- agent/event
- agent/first-publish-date
- agent/last-modified-date
- agent/softwarecombine
- agent/remedy
- vendor/xen
- canonical/xen xen
- version/xen xen/4.6.0
- version/xen xen/4.6.1
- version/xen xen/4.6.3
- version/xen xen/4.6.4
- version/xen xen/4.6.5
- version/xen xen/4.6.6
- version/xen xen/4.7.0
- version/xen xen/4.7.1
- version/xen xen/4.7.2
- version/xen xen/4.7.3
- version/xen xen/4.8.0
- version/xen xen/4.8.1
- version/xen xen/4.9.0
- vendor/citrix
- canonical/citrix xenserver
- version/citrix xenserver/6.0.2
- version/citrix xenserver/6.2.0
- version/citrix xenserver/6.5
- version/citrix xenserver/7.0
- version/citrix xenserver/7.1
- version/citrix xenserver/7.2
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/8.0
- version/debian debian linux/9.0