Ubuntu.comUB:CVE-2010-4247CVE-2010-4247
5.5 Medium
CVSS2
Access Vector
ADJACENT_NETWORK
Access Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
COMPLETE
AV:A/AC:L/Au:S/C:N/I:N/A:C
0.001 Low
EPSS
Percentile
27.0%
The do_block_io_op function in (1) drivers/xen/blkback/blkback.c and (2)
drivers/xen/blktap/blktap.c in Xen before 3.4.0 for the Linux kernel
2.6.18, and possibly other versions, allows guest OS users to cause a
denial of service (infinite loop and CPU consumption) via a large
production request index to the blkback or blktap back-end drivers. NOTE:
some of these details are obtained from third party information.
Notes
| Author | Note |
|---|---|
| jdstrand | xen-3.1 has linux-2.6-xen-sparse/drivers/xen/blkback/blkback.c, but xen-3.2 and xen-3.3 do not marking dapper task as ignored since we no longer support xen userspace on Dapper anyway |
| smb | My feeling is that xen-3.1 has code affected, but does not package that up. That would make only Hardy kernel code truely affected. Oneiric not-affected for now (not containing blkback) and when we move to upstream v3.0 is is fixed there. |
Related
5.5 Medium
CVSS2
Access Vector
ADJACENT_NETWORK
Access Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
COMPLETE
AV:A/AC:L/Au:S/C:N/I:N/A:C
0.001 Low
EPSS
Percentile
27.0%