xen-kernel -- Information leak through version information hypercall

ID EF9D041E-27E2-11E5-A4A5-002590263BF5
Type freebsd
Reporter FreeBSD
Modified 2015-03-05T00:00:00


The Xen Project reports:

The code handling certain sub-operations of the HYPERVISOR_xen_version hypercall fails to fully initialize all fields of structures subsequently copied back to guest memory. Due to this hypervisor stack contents are copied into the destination of the operation, thus becoming visible to the guest. A malicious guest might be able to read sensitive data relating to other guests.