REDHAT-BUG-896038: Medium severity xenserver vulnerability
A flaw was found in the way xenfailsafecallback() handled failed iret, which causes the stack pointer to be wrong when entering the iretexc error path. An unprivileged local guest user in the 32-bit PV Xen domain could use this flaw to crash the guest.
References: http://www.openwall.com/lists/oss-security/2013/01/16/6
Acknowledgements:
Red Hat would like to thank the Andrew Cooper of Citrix for reporting this issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-896038?
The severity of REDHAT-BUG-896038 is considered significant due to its impact on unprivileged guest users in a 32-bit PV Xen domain.
How do I fix REDHAT-BUG-896038?
To fix REDHAT-BUG-896038, ensure that you apply the latest patches and updates specific to your version of Citrix Xen.
Who is affected by REDHAT-BUG-896038?
REDHAT-BUG-896038 primarily affects unprivileged local guest users operating in a 32-bit PV Xen domain.
What components are involved in REDHAT-BUG-896038?
REDHAT-BUG-896038 involves the xen_failsafe_callback() function within the Citrix Xen architecture.
Can REDHAT-BUG-896038 allow unauthorized access?
REDHAT-BUG-896038 does not allow unauthorized access but can cause a crash of the guest system.