x86: broken check in memory_exchange() permits PV guest breakout

2017-04-0412:00:00

Xen Project

xenbits.xen.org

8.2 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

7.2 High

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

0.001 Low

EPSS

Percentile

40.8%

JSON

ISSUE DESCRIPTION

The XSA-29 fix introduced an insufficient check on XENMEM_exchange input, allowing the caller to drive hypervisor memory accesses outside of the guest provided input/output arrays.

IMPACT

A malicious or buggy 64-bit PV guest may be able to access all of system memory, allowing for all of privilege escalation, host crashes, and information leaks.

VULNERABLE SYSTEMS

All Xen versions are vulnerable.
Only x86 systems are affected. ARM systems are not vulnerable.
The vulnerability is only exposed to 64-bit PV guests. HVM guests and 32-bit PV guests can’t exploit the vulnerability.