Re: Xen Security Advisory 92 - HVMOP_set_mem_type allows invalid P2M entries to be created

[cve-assign () mitre org]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

> XSA-92

> attempts to exclude transitioning a page from an inappropriate memory
> type. However, only an inadequate subset of memory types is excluded.
> ... page table translation can be inappropriately changed ... If this
> occurs, an invalid translation will be established.
>
> In the more general case, in more abstract terms: a malicious
> administrator of a domain privileged with regard to an HVM guest can
> cause Xen to crash
>
> the extra isolation does not provide as good a defence (against denial
> of service) as intended. That is the essence of this vulnerability.

Use CVE-2014-3124.

> the chroot technique as found in some versions of XCP/XenServer

Our expectation is that the specific version set for these XCP and
XenServer versions does not mean that there are different attacks
possible (e.g., with different "inappropriate memory types") against
different affected versions.

- -- 
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)

iQEcBAEBAgAGBQJTYVosAAoJEKllVAevmvmsDOcIAMcUfaX0Uo31VFN5VlLrlhLl
eonm4ci4VGIW4PSvxiaAmqJvZn7Ab7nvhRRGhoFkKOsSYVepbA28gZ7wVkBn04cZ
Jx5zN3Zaia6zuMy/UFO3HjzR25k8yWm9KlzBrY4P5ynP6TnYbzoM8IpQd3FMyjxb
2TlB4WTI28ilcLK0jTSpxsOUyIsRNeKQicUFMKJNVv+l/sRKLVStYbMlWJ+h6i5x
5jpjIcCrd03oyEfzH1E81aHx1zsGkRTl4WXqUjyWYKkV02c5j/j+Dvn/Axody7Ri
QjE1cNQfG/gkwKSq/b7I4H/0wFnVMM7BBuvcXYJkYU2i6IhZ1R3iZVYrNZzKcKY=
=CjnC
-----END PGP SIGNATURE-----