[vendor-sec] [oss-security] New Xen ioemu: PVFB backend issue

[Jan Lieskovsky <jlieskov () redhat com>]

Hello guys,

  on May the 15th, the following report has been posted to the
xen-unstable list:


Problem description:
====================

ioemu: Fix PVFB backend to limit frame buffer size

The recent fix to validate the frontend's frame buffer description
neglected to limit the frame buffer size correctly. This lets a
malicious frontend make the backend attempt to map an arbitrary amount
of guest memory, which could be useful for a denial of service attack
against dom0.

Proposed fix:
============

http://xenbits.xensource.com/xen-unstable.hg?rev/9044705960cb30cec385bdca7305bcf7db096721


As this vulnerability has security implications, we have assigned
CVE-2008-1952 to it. Please use it when referring to this issue.


Kind regards
Jan iankko Lieskovsky
RH kernel Security Response Team