Lucene search

Xen ProjectXSA-362

HistoryFeb 16, 2021 - 12:00 p.m.

Linux: backends treating grant mapping errors as bugs

2021-02-1612:00:00

Xen Project

xenbits.xen.org

linux

backends

grant mapping

errors

kernel crash

memory allocations

guest influence

frontend driver

backend driver

domain

vulnerable systems .

CVSS2

1.9

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:L/AC:M/Au:N/C:N/I:N/A:P

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS

Percentile

14.2%

JSON

ISSUE DESCRIPTION

Block, net, and SCSI backends consider certain errors a plain bug, deliberately causing a kernel crash. For errors potentially being at least under the influence of guests, like out of memory conditions, it isn’t correct to assume so. Memory allocations potentially causing such crashes occur only when Linux is running in PV mode, though.

IMPACT

A malicious or buggy frontend driver may be able to crash the corresponding backend driver, potentially affecting the entire domain running the backend driver.

VULNERABLE SYSTEMS

Linux versions from at least 2.6.39 onwards are vulnerable, when run in PV mode. Earlier versions differ significantly in behavior and may therefore instead surface other issues under the same conditions. Linux run in HVM / PVH modes is not vulnerable.