x86 segment base write emulation lacking canonical address checks

2016-11-2212:00:00

Xen Project

xenbits.xen.org

6 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H

4.9 Medium

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:N/I:N/A:C

0.001 Low

EPSS

Percentile

25.6%

JSON

ISSUE DESCRIPTION

Both writes to the FS and GS register base MSRs as well as the WRFSBASE and WRGSBASE instructions require their input values to be canonical, or a #GP fault will be raised. When the use of those instructions by the hypervisor was enabled, the previous guard against #GP faults (having recovery code attached) was accidentally removed.

IMPACT

A malicious guest administrator can crash the host, leading to a DoS.

VULNERABLE SYSTEMS

Xen versions 4.4 and onwards are affected. Xen versions 4.3 and earlier are not affected.
The vulnerability is only exposed to x86 PV guests.
The vulnerability is NOT exposed to x86 HVM guests.
ARM systems are NOT vulnerable.