Lucene search

K
xenXen ProjectXSA-333
HistorySep 22, 2020 - 12:00 p.m.

x86 pv: Crash when handling guest access to MSR_MISC_ENABLE

2020-09-2212:00:00
Xen Project
xenbits.xen.org
32

4.6 Medium

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:L/AC:L/Au:S/C:N/I:N/A:C

6 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H

0.0004 Low

EPSS

Percentile

14.2%

ISSUE DESCRIPTION

When a guest accesses certain Model Specific Registers, Xen first reads the value from hardware to use as the basis for auditing the guest access.
For the MISC_ENABLE MSR, which is an Intel specific MSR, this MSR read is performed without error handling for a #GP fault, which is the consequence of trying to read this MSR on non-Intel hardware.

IMPACT

A buggy or malicious PV guest administrator can crash Xen, resulting in a host Denial of Service.

VULNERABLE SYSTEMS

Only x86 systems are vulnerable. ARM systems are not vulnerable.
Only Xen versions 4.11 and onwards are vulnerable. 4.10 and earlier are not vulnerable.
Only x86 systems which do not implement the MISC_ENABLE MSR (0x1a0) are vulnerable. AMD and Hygon systems do not implement this MSR and are vulnerable. Intel systems do implement this MSR and are not vulnerable. Other manufacturers have not been checked.
Only x86 PV guests can exploit the vulnerability. x86 HVM/PVH guests cannot exploit the vulnerability.

CPENameOperatorVersion
xenge4.11

4.6 Medium

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:L/AC:L/Au:S/C:N/I:N/A:C

6 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H

0.0004 Low

EPSS

Percentile

14.2%