kernel: xen: Memory mapping failure can crash Xen

Xen 3.4 through 4.2, and possibly earlier versions, does not properly synchronize the p2m and m2p tables when the setp2mentry function fails, which allows local HVM guest OS administrators to cause a denial of service memory consumption and assertion failure, aka "Memory mapping failure DoS...

DEBIAN-CVE-2012-3432

The handlemmio function in arch/x86/hvm/io.c in the MMIO operations emulator for Xen 3.3 and 4.x, when running an HVM guest, does not properly reset certain state information between emulation cycles, which allows local guest OS users to cause a denial of service guest OS crash via unspecified...

CVE-2012-3432

The handlemmio function in arch/x86/hvm/io.c in the MMIO operations emulator for Xen 3.3 and 4.x, when running an HVM guest, does not properly reset certain state information between emulation cycles, which allows local guest OS users to cause a denial of service guest OS crash via unspecified...

CVE-2012-3432

The handlemmio function in arch/x86/hvm/io.c in the MMIO operations emulator for Xen 3.3 and 4.x, when running an HVM guest, does not properly reset certain state information between emulation cycles, which allows local guest OS users to cause a denial of service guest OS crash via unspecified...

Design/Logic Flaw

The handlemmio function in arch/x86/hvm/io.c in the MMIO operations emulator for Xen 3.3 and 4.x, when running an HVM guest, does not properly reset certain state information between emulation cycles, which allows local guest OS users to cause a denial of service guest OS crash via unspecified...

Broken error handling in guest_physmap_mark_populate_on_demand()

ISSUE DESCRIPTION guestphysmapmarkpopulateondemand, before carrying out its actual operation, checks that the subject GFNs are not in use. If that check fails, the code prints a message and bypasses the gfnunlock matching the gfnlock carried out before entering the loop. Further, the function is...

several HVM operations do not validate the range of their inputs

ISSUE DESCRIPTION Several HVM control operations do not check the size of their inputs and can tie up a physical CPU for extended periods of time. In addition dirty video RAM tracking involves clearing the bitmap provided by the domain controlling the guest e.g. dom0 or a stubdom. If the size of...

HVMOP_get_mem_access crash / HVMOP_set_mem_access information leak

ISSUE DESCRIPTION The HVMOPsetmemaccess operation handler uses an input as an array index before range checking it. IMPACT A malicious guest administrator can cause Xen to crash. If the out of array bounds access does not crash, the arbitrary value read will be used if the caller reads back the...

CVE-2012-3432: Undefined Security Weakness

The handlemmio function in arch/x86/hvm/io.c in the MMIO operations emulator for Xen 3.3 and 4.x, when running an HVM guest, does not properly reset certain state information between emulation cycles, which allows local guest OS users to cause a denial of service guest OS crash via unspecified...

CVE-2012-4538

The HVMOPpagetabledying hypercall in Xen 4.0, 4.1, and 4.2 does not properly check the pagetable state when running on shadow pagetables, which allows a local HVM guest OS to cause a denial of service hypervisor crash via unspecified vectors...

CVE-2012-3433

Xen 4.0 and 4.1 allows local HVM guest OS kernels to cause a denial of service domain 0 VCPU hang and kernel panic by modifying the physical address space in a way that triggers excessive shared page search time during the p2m teardown...

CVE-2012-4538

The HVMOPpagetabledying hypercall in Xen 4.0, 4.1, and 4.2 does not properly check the pagetable state when running on shadow pagetables, which allows a local HVM guest OS to cause a denial of service hypervisor crash via unspecified vectors...

CVE-2012-3433

Xen 4.0 and 4.1 allows local HVM guest OS kernels to cause a denial of service domain 0 VCPU hang and kernel panic by modifying the physical address space in a way that triggers excessive shared page search time during the p2m teardown...

CVE-2012-3433

Xen 4.0 and 4.1 allows local HVM guest OS kernels to cause a denial of service domain 0 VCPU hang and kernel panic by modifying the physical address space in a way that triggers excessive shared page search time during the p2m teardown...

CVE-2012-4538

The HVMOPpagetabledying hypercall in Xen 4.0, 4.1, and 4.2 does not properly check the pagetable state when running on shadow pagetables, which allows a local HVM guest OS to cause a denial of service hypervisor crash via unspecified vectors...

CVE-2012-3433: Undefined Security Weakness

Xen 4.0 and 4.1 allows local HVM guest OS kernels to cause a denial of service domain 0 VCPU hang and kernel panic by modifying the physical address space in a way that triggers excessive shared page search time during the p2m teardown...

DEBIAN-CVE-2012-3498

PHYSDEVOPmappirq in Xen 4.1 and 4.2 and Citrix XenServer 6.0.2 and earlier allows local HVM guest OS kernels to cause a denial of service host crash and possibly read hypervisor or guest memory via vectors related to a missing range check of map-index...

Fedora 17 : xen-4.1.3-6.fc17 (2012-18242)

A guest can block a cpu by setting a bad VCPU deadline XSA 20, CVE-2012-4535 876198 HVM guest can use invalid pirq values to crash xen XSA 21, CVE-2012-4536 876200 HVM guest can exhaust p2m table crashing xen XSA 22, CVE-2012-4537 876203 PAE HVM guest can crash hypervisor XSA-23, CVE-2012-4538...

Fedora 16 : xen-4.1.3-4.fc16 (2012-18249)

A guest can block a cpu by setting a bad VCPU deadline XSA 20, CVE-2012-4535 876198 HVM guest can use invalid pirq values to crash xen XSA 21, CVE-2012-4536 876200 HVM guest can exhaust p2m table crashing xen XSA 22, CVE-2012-4537 876203 PAE HVM guest can crash hypervisor XSA-23, CVE-2012-4538...

CVE-2012-4537

Xen 3.4 through 4.2, and possibly earlier versions, does not properly synchronize the p2m and m2p tables when the setp2mentry function fails, which allows local HVM guest OS administrators to cause a denial of service memory consumption and assertion failure, aka "Memory mapping failure DoS...