Xen in the Linux kernel, when running a guest on a host without hardware assisted paging (HAP), allows guest users to cause a denial of service (invalid pointer dereference and hypervisor crash) via the SAHF instruction.
Weakness
The product dereferences a pointer that it expects to be valid but is NULL.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Xen | Xen | * | 3.3.0 (excluding) |
| Red Hat Enterprise Linux 5 | RedHat | kernel-0:2.6.18-274.3.1.el5 | * |
| Red Hat Enterprise Linux 5.6 EUS - Server Only | RedHat | kernel-0:2.6.18-238.31.1.el5 | * |
| Xen-3.1 | Ubuntu | hardy | * |
| Xen-3.2 | Ubuntu | hardy | * |
| Xen-3.3 | Ubuntu | maverick | * |
| Xen-3.3 | Ubuntu | natty | * |
Potential Mitigations
References
- http://rhn.redhat.com/errata/RHSA-2011-1212.html
- http://www.openwall.com/lists/oss-security/2011/08/30/1
- http://xenbits.xen.org/hg/xen-3.1-testing.hg/rev/15644
- https://bugzilla.redhat.com/show_bug.cgi?id=718882
- http://rhn.redhat.com/errata/RHSA-2011-1212.html
- http://www.openwall.com/lists/oss-security/2011/08/30/1
- http://xenbits.xen.org/hg/xen-3.1-testing.hg/rev/15644
- https://bugzilla.redhat.com/show_bug.cgi?id=718882