ID CVE-2010-4255
Summary The fixup_page_fault function in arch/x86/traps.c in Xen 4.0.1 and earlier on 64-bit platforms, when paravirtualization is enabled, does not verify that kernel mode is used to call the handle_gdt_ldt_mapping_fault function, which allows guest OS users to cause a denial of service (host OS BUG_ON) via a crafted memory access.
References
Vulnerable Configurations
  • cpe:2.3:a:citrix:xen:3.0.2
    cpe:2.3:a:citrix:xen:3.0.2
  • cpe:2.3:a:citrix:xen:3.0.3
    cpe:2.3:a:citrix:xen:3.0.3
  • cpe:2.3:a:citrix:xen:3.0.4
    cpe:2.3:a:citrix:xen:3.0.4
  • cpe:2.3:a:citrix:xen:3.1.2
    cpe:2.3:a:citrix:xen:3.1.2
  • cpe:2.3:a:citrix:xen:3.1.3
    cpe:2.3:a:citrix:xen:3.1.3
  • cpe:2.3:a:citrix:xen:3.1.4
    cpe:2.3:a:citrix:xen:3.1.4
  • cpe:2.3:a:citrix:xen:3.2.0
    cpe:2.3:a:citrix:xen:3.2.0
  • cpe:2.3:a:citrix:xen:3.2.1
    cpe:2.3:a:citrix:xen:3.2.1
  • cpe:2.3:a:citrix:xen:3.2.2
    cpe:2.3:a:citrix:xen:3.2.2
  • cpe:2.3:a:citrix:xen:3.2.3
    cpe:2.3:a:citrix:xen:3.2.3
  • cpe:2.3:a:citrix:xen:3.3.0
    cpe:2.3:a:citrix:xen:3.3.0
  • cpe:2.3:a:citrix:xen:3.3.1
    cpe:2.3:a:citrix:xen:3.3.1
  • cpe:2.3:a:citrix:xen:3.3.2
    cpe:2.3:a:citrix:xen:3.3.2
  • cpe:2.3:a:citrix:xen:3.4.0
    cpe:2.3:a:citrix:xen:3.4.0
  • cpe:2.3:a:citrix:xen:3.4.1
    cpe:2.3:a:citrix:xen:3.4.1
  • cpe:2.3:a:citrix:xen:3.4.2
    cpe:2.3:a:citrix:xen:3.4.2
  • cpe:2.3:a:citrix:xen:3.4.3
    cpe:2.3:a:citrix:xen:3.4.3
  • cpe:2.3:a:citrix:xen:4.0.0
    cpe:2.3:a:citrix:xen:4.0.0
  • cpe:2.3:a:citrix:xen:4.0.1
    cpe:2.3:a:citrix:xen:4.0.1
CVSS
Base: 6.1 (as of 25-01-2011 - 12:58)
Impact:
Exploitability:
Access
VectorComplexityAuthentication
ADJACENT_NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
NONE NONE COMPLETE
nessus via4
  • NASL family Misc.
    NASL id VMWARE_VMSA-2011-0012_REMOTE.NASL
    description The remote VMware ESX / ESXi host is missing a security-related patch. It is, therefore, affected by multiple vulnerabilities in several third-party components and libraries : - Kernel - krb5 - glibc - mtp2sas - mptsas - mptspi
    last seen 2019-02-21
    modified 2018-08-16
    plugin id 89680
    published 2016-03-04
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=89680
    title VMware ESX / ESXi Third-Party Libraries Multiple Vulnerabilities (VMSA-2011-0012) (remote check)
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2011-0017.NASL
    description Updated kernel packages that fix multiple security issues, address several hundred bugs, and add numerous enhancements are now available as part of the ongoing support and maintenance of Red Hat Enterprise Linux version 5. This is the sixth regular update. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. The kernel packages contain the Linux kernel, the core of any Linux operating system. This update fixes the following security issues : * A NULL pointer dereference flaw was found in the igb driver in the Linux kernel. If both the Single Root I/O Virtualization (SR-IOV) feature and promiscuous mode were enabled on an interface using igb, it could result in a denial of service when a tagged VLAN packet is received on that interface. (CVE-2010-4263, Important) * A missing sanity check was found in vbd_create() in the Xen hypervisor implementation. As CD-ROM drives are not supported by the blkback back-end driver, attempting to use a virtual CD-ROM drive with blkback could trigger a denial of service (crash) on the host system running the Xen hypervisor. (CVE-2010-4238, Moderate) * A flaw was found in the Linux kernel execve() system call implementation. A local, unprivileged user could cause large amounts of memory to be allocated but not visible to the OOM (Out of Memory) killer, triggering a denial of service. (CVE-2010-4243, Moderate) * A flaw was found in fixup_page_fault() in the Xen hypervisor implementation. If a 64-bit para-virtualized guest accessed a certain area of memory, it could cause a denial of service on the host system running the Xen hypervisor. (CVE-2010-4255, Moderate) * A missing initialization flaw was found in the bfa driver used by Brocade Fibre Channel Host Bus Adapters. A local, unprivileged user could use this flaw to cause a denial of service by reading a file in the '/sys/class/fc_host/host#/statistics/' directory. (CVE-2010-4343, Moderate) * Missing initialization flaws in the Linux kernel could lead to information leaks. (CVE-2010-3296, CVE-2010-3877, CVE-2010-4072, CVE-2010-4073, CVE-2010-4075, CVE-2010-4080, CVE-2010-4081, CVE-2010-4158, Low) Red Hat would like to thank Kosuke Tatsukawa for reporting CVE-2010-4263; Vladymyr Denysov for reporting CVE-2010-4238; Brad Spengler for reporting CVE-2010-4243; Dan Rosenberg for reporting CVE-2010-3296, CVE-2010-4073, CVE-2010-4075, CVE-2010-4080, CVE-2010-4081, and CVE-2010-4158; Vasiliy Kulikov for reporting CVE-2010-3877; and Kees Cook for reporting CVE-2010-4072. These updated packages also include several hundred bug fixes for and enhancements to the Linux kernel. Space precludes documenting each of these changes in this advisory and users are directed to the Red Hat Enterprise Linux 5.6 Release Notes for information on the most significant of these changes : http://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/5/html/ 5.6_Release_Notes/index.html Refer to the kernel chapter in the Red Hat Enterprise Linux 5.6 Technical Notes for further information : http://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/5/html/ 5.6_Technical_Notes/kernel.html All Red Hat Enterprise Linux 5 users are advised to install these updated packages, which address these vulnerabilities as well as fixing the bugs and adding the enhancements noted in the Red Hat Enterprise Linux 5.6 Release Notes and Technical Notes. The system must be rebooted for this update to take effect.
    last seen 2019-02-21
    modified 2018-12-20
    plugin id 51522
    published 2011-01-14
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=51522
    title RHEL 5 : kernel (RHSA-2011:0017)
  • NASL family VMware ESX Local Security Checks
    NASL id VMWARE_VMSA-2011-0012.NASL
    description a. ESX third-party update for Service Console kernel This update takes the console OS kernel package to kernel-2.6.18-238.9.1 which resolves multiple security issues. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2010-1083, CVE-2010-2492, CVE-2010-2798, CVE-2010-2938, CVE-2010-2942, CVE-2010-2943, CVE-2010-3015, CVE-2010-3066, CVE-2010-3067, CVE-2010-3078, CVE-2010-3086, CVE-2010-3296, CVE-2010-3432, CVE-2010-3442, CVE-2010-3477, CVE-2010-3699, CVE-2010-3858, CVE-2010-3859, CVE-2010-3865, CVE-2010-3876, CVE-2010-3877, CVE-2010-3880, CVE-2010-3904, CVE-2010-4072, CVE-2010-4073, CVE-2010-4075, CVE-2010-4080, CVE-2010-4081, CVE-2010-4083, CVE-2010-4157, CVE-2010-4158, CVE-2010-4161, CVE-2010-4238, CVE-2010-4242, CVE-2010-4243, CVE-2010-4247, CVE-2010-4248, CVE-2010-4249, CVE-2010-4251, CVE-2010-4255, CVE-2010-4263, CVE-2010-4343, CVE-2010-4346, CVE-2010-4526, CVE-2010-4655, CVE-2011-0521, CVE-2011-0710, CVE-2011-1010, CVE-2011-1090 and CVE-2011-1478 to these issues. b. ESX third-party update for Service Console krb5 RPMs This patch updates the krb5-libs and krb5-workstation RPMs of the console OS to version 1.6.1-55.el5_6.1, which resolves multiple security issues. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2010-1323, CVE-2011-0281, and CVE-2011-0282 to these issues. c. ESXi and ESX update to third-party component glibc The glibc third-party library is updated to resolve multiple security issues. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2010-0296, CVE-2011-0536, CVE-2011-1071, CVE-2011-1095, CVE-2011-1658, and CVE-2011-1659 to these issues. d. ESX update to third-party drivers mptsas, mpt2sas, and mptspi The mptsas, mpt2sas, and mptspi drivers are updated which addresses multiple security issues in the mpt2sas driver. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2011-1494 and CVE-2011-1495 to these issues.
    last seen 2019-02-21
    modified 2018-09-06
    plugin id 56508
    published 2011-10-14
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=56508
    title VMSA-2011-0012 : VMware ESXi and ESX updates to third-party libraries and ESX Service Console
redhat via4
advisories
rhsa
id RHSA-2011:0017
rpms
  • kernel-0:2.6.18-238.el5
  • kernel-PAE-0:2.6.18-238.el5
  • kernel-PAE-devel-0:2.6.18-238.el5
  • kernel-debug-0:2.6.18-238.el5
  • kernel-debug-devel-0:2.6.18-238.el5
  • kernel-devel-0:2.6.18-238.el5
  • kernel-doc-0:2.6.18-238.el5
  • kernel-headers-0:2.6.18-238.el5
  • kernel-kdump-0:2.6.18-238.el5
  • kernel-kdump-devel-0:2.6.18-238.el5
  • kernel-xen-0:2.6.18-238.el5
  • kernel-xen-devel-0:2.6.18-238.el5
refmap via4
bugtraq 20111013 VMSA-2011-0012 VMware ESXi and ESX updates to third party libraries and ESX Service Console
confirm
mlist
  • [oss-security] 20101130 CVE request: xen: x86-64: don't crash Xen upon direct pv guest access
  • [oss-security] 20101130 Re: CVE request: xen: x86-64: don't crash Xen upon direct pv guest access
  • [xen-devel] 20101129 [PATCH] x86-64: don't crash Xen upon direct pv guest access
secunia
  • 42884
  • 46397
Last major update 25-10-2011 - 22:54
Published 24-01-2011 - 20:00
Last modified 10-10-2018 - 16:07
Back to Top