guest 32-bit ELF symbol table load leaking host data

2016-11-2212:00:00

Xen Project

xenbits.xen.org

6.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

2.1 Low

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

0.001 Low

EPSS

Percentile

24.6%

JSON

ISSUE DESCRIPTION

Along with their main kernel binary, unprivileged guests may arrange to have their Xen environment load (kernel) symbol tables for their use. The ELF image metadata created for this purpose has a few unused bytes when the symbol table binary is in 32-bit ELF format. These unused bytes were not properly cleared during symbol table loading.

IMPACT

A malicious unprivileged guest may be able to obtain sensitive information from the host.
The information leak is small and not under the control of the guest, so effectively exploiting this vulnerability is probably difficult.

VULNERABLE SYSTEMS

Only Xen version 4.7 is affected. Xen versions 4.6 and earlier are not affected.
The vulnerability is not exposed to x86 HVM guests, unless the host toolstack has configured to load the guest with a non-default loader, rather than hvmloader.