stack corruption from XSA-346 change

2020-11-2412:00:00

Xen Project

xenbits.xen.org

4.6 Medium

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:P/A:P

8.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

0.0004 Low

EPSS

Percentile

12.7%

JSON

ISSUE DESCRIPTION

One of the two changes for XSA-346 introduced an on-stack array. The check for guarding against overrunning this array was off by one, allowing for corruption of the first stack slot immediately following this array.

IMPACT

A malicious or buggy HVM or PVH guest can cause Xen to crash, resulting in a Denial of Service (DoS) to the entire host. Privilege escalation as well as information leaks cannot be excluded.

VULNERABLE SYSTEMS

All Xen versions which have the patches for XSA-346 applied are vulnerable.
Only x86 HVM and PVH guests can leverage the vulnerability. Arm guests and x86 PV guests cannot leverage the vulnerability.
Only x86 HVM and PVH guests which have physical devices passed through to them can leverage the vulnerability.