Multiple integer overflows in tools/libxc/xc_dom_bzimageloader.c in Xen 3.2, 3.3, 4.0, and 4.1 allow local users to cause a denial of service and possibly execute arbitrary code via a crafted paravirtualised guest kernel image that triggers (1) a buffer overflow during a decompression loop or (2) an out-of-bounds read in the loader involving unspecified length fields.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Xen | Citrix | 3.2.0 (including) | 3.2.0 (including) |
| Xen | Citrix | 3.3.0 (including) | 3.3.0 (including) |
| Xen | Citrix | 4.0.0 (including) | 4.0.0 (including) |
| Xen | Citrix | 4.1.0 (including) | 4.1.0 (including) |
| Red Hat Enterprise Linux 5 | RedHat | xen-0:3.0.3-120.el5_6.2 | * |
| Xen | Ubuntu | upstream | * |
| Xen-3.1 | Ubuntu | hardy | * |
| Xen-3.2 | Ubuntu | hardy | * |
| Xen-3.3 | Ubuntu | lucid | * |
| Xen-3.3 | Ubuntu | maverick | * |
| Xen-3.3 | Ubuntu | natty | * |
References
- http://lists.xensource.com/archives/html/xen-devel/2011-05/msg00483.html
- http://lists.xensource.com/archives/html/xen-devel/2011-05/msg00491.html
- http://rhn.redhat.com/errata/RHSA-2011-0496.html
- http://lists.xensource.com/archives/html/xen-devel/2011-05/msg00483.html
- http://lists.xensource.com/archives/html/xen-devel/2011-05/msg00491.html
- http://rhn.redhat.com/errata/RHSA-2011-0496.html