The fixup_page_fault function in arch/x86/traps.c in Xen 4.0.1 and earlier on 64-bit platforms, when paravirtualization is enabled, does not verify that kernel mode is used to call the handle_gdt_ldt_mapping_fault function, which allows guest OS users to cause a denial of service (host OS BUG_ON) via a crafted memory access.
http://lists.xensource.com/archives/html/xen-devel/2010-11/msg01650.html
http://openwall.com/lists/oss-security/2010/11/30/5
http://openwall.com/lists/oss-security/2010/11/30/8
http://secunia.com/advisories/42884
http://secunia.com/advisories/46397
http://www.redhat.com/support/errata/RHSA-2011-0017.html
http://www.securityfocus.com/archive/1/520102/100/0/threaded
http://www.vmware.com/security/advisories/VMSA-2011-0012.html
Source: MITRE
Published: 2011-01-25
Updated: 2018-10-10
Type: NVD-CWE-Other
Base Score: 6.1
Vector: AV:A/AC:L/Au:N/C:N/I:N/A:C
Impact Score: 6.9
Exploitability Score: 6.5
Severity: MEDIUM
OR
cpe:2.3:a:citrix:xen:3.0.2:*:*:*:*:*:*:*
cpe:2.3:a:citrix:xen:3.0.3:*:*:*:*:*:*:*
cpe:2.3:a:citrix:xen:3.0.4:*:*:*:*:*:*:*
cpe:2.3:a:citrix:xen:3.1.2:*:*:*:*:*:*:*
cpe:2.3:a:citrix:xen:3.1.3:*:*:*:*:*:*:*
cpe:2.3:a:citrix:xen:3.1.4:*:*:*:*:*:*:*
cpe:2.3:a:citrix:xen:3.2.0:*:*:*:*:*:*:*
cpe:2.3:a:citrix:xen:3.2.1:*:*:*:*:*:*:*
cpe:2.3:a:citrix:xen:3.2.2:*:*:*:*:*:*:*
cpe:2.3:a:citrix:xen:3.2.3:*:*:*:*:*:*:*
cpe:2.3:a:citrix:xen:3.3.0:*:*:*:*:*:*:*
cpe:2.3:a:citrix:xen:3.3.1:*:*:*:*:*:*:*
cpe:2.3:a:citrix:xen:3.3.2:*:*:*:*:*:*:*
cpe:2.3:a:citrix:xen:3.4.0:*:*:*:*:*:*:*
cpe:2.3:a:citrix:xen:3.4.1:*:*:*:*:*:*:*
cpe:2.3:a:citrix:xen:3.4.2:*:*:*:*:*:*:*
cpe:2.3:a:citrix:xen:3.4.3:*:*:*:*:*:*:*
cpe:2.3:a:citrix:xen:4.0.0:*:*:*:*:*:*:*
cpe:2.3:a:citrix:xen:*:*:*:*:*:*:*:* versions up to 4.0.1 (inclusive)
ID | Name | Product | Family | Severity |
---|---|---|---|---|
89680 | VMware ESX / ESXi Third-Party Libraries Multiple Vulnerabilities (VMSA-2011-0012) (remote check) | Nessus | Misc. | high |
56508 | VMSA-2011-0012 : VMware ESXi and ESX updates to third-party libraries and ESX Service Console | Nessus | VMware ESX Local Security Checks | high |
51522 | RHEL 5 : kernel (RHSA-2011:0017) | Nessus | Red Hat Local Security Checks | medium |