Re: Xen Security Advisory 95 - input handling vulnerabilities loading guest kernel on ARM

[cve-assign () mitre org]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

> Xen Security Advisory XSA-95

We would like to model this one as having four distinct primary issues.
In other words, although the concepts of missing validation are
similar, and the impacts may be the same, the types of validation can
be categorized separately. Thus, there are four CVE IDs.

> When loading a 32-bit ARM guest kernel the Xen tools did not correctly
> validate the length of the kernel against the actual image size. This
> would then lead to an overrun on the input buffer when loading the
> kernel into guest RAM.

Use CVE-2014-3714.


> Furthermore when checking a 32-bit guest kernel for an appended DTB,
> the Xen tools were prone to additional overruns also leading to an
> overrun on the input buffer when loading the kernel into guest RAM.

Use CVE-2014-3715.


> Also, the tools would access a field in the putative DTB header
> without checking for its alignment.

Use CVE-2014-3716.


> When loading a 64-bit ARM guest kernel the tools similarly did not
> fully validate the requested load addresses, possibly leading to an
> overrun on the input buffer when loading the kernel into guest RAM.

Use CVE-2014-3717.

- -- 
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)

iQEcBAEBAgAGBQJTdPXqAAoJEKllVAevmvmsHAQH/RZMLQmt/JDGo6O0ZnMkzyMH
tTXkjVjZI6Y2+DV5pFza5McAg3GXjlIxJztmsoWxic0Q7YEaNlH4bgt4lscQyzhR
xkBFkU7aRUP3k7FOpY55Sf9jER6NycgrnD3+hyQdeBrg5lkIpiw0eaOrIMzep1uE
xlmRA1ZTrvDA3nMEBAJ1dxCmuAj2GpIqTO5vCKKAOnFfjuTVjoPHNBfdRb9biRZW
vR3jJmmpnc6OdwuAdMKGrhGuKh0qQb7AH0JaGhB0i0C1R2ahxHl5X/xnnxkXCgIw
Yz3MvGOGiS8r9dPwl6XPmuBK5Q/wAAWVQVA6uTZSZZX/fVdR6FkY71syIYk/NC4=
=sfjR
-----END PGP SIGNATURE-----