Lucene search

K
xenXen ProjectXSA-152
HistoryOct 29, 2015 - 11:59 a.m.

x86: some pmu and profiling hypercalls log without rate limiting

2015-10-2911:59:00
Xen Project
xenbits.xen.org
27

2.1 Low

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:N/I:N/A:P

0.001 Low

EPSS

Percentile

25.6%

ISSUE DESCRIPTION

HYPERCALL_xenoprof_op and HYPERVISOR_xenpmu_op log some errors and attempts at invalid operations.
These log messages are not rate-limited, even though they can be triggered by guests.

IMPACT

A malicious guest could cause repeated logging to the hypervisor console, leading to a Denial of Service attack.

VULNERABLE SYSTEMS

Xen versions 3.2.x and later are affected. (The VPMU part of the vulnerability is applicable only to Xen 4.6 and later.)
ARM systems are not affected. (The pmu hypercall is x86-specific, and xenoprof is not supported on ARM.)

CPENameOperatorVersion
xenge3.2.x

2.1 Low

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:N/I:N/A:P

0.001 Low

EPSS

Percentile

25.6%