PT-2010-4422 · Xen+2 · Xen+2

Publicado

2010-09-29

·

Atualizado

2018-10-10

·

CVE-2010-2938

CVSS v2.0

4.9

Média

VetorAV:L/AC:L/Au:N/C:N/I:N/A:C
Name of the Vulnerable Software and Affected Versions Linux kernel version 2.6.18
Description The issue allows local users to cause a denial of service, resulting in a host OS crash, by requesting a VMCS dump for a fully virtualized Xen guest on an Intel platform without Extended Page Tables (EPT) functionality. This occurs because the virtual-machine control structure (VMCS) implementation accesses VMCS fields without verifying hardware support for these fields.
Recommendations For Linux kernel version 2.6.18, consider disabling the VMCS dump functionality for fully virtualized Xen guests on Intel platforms without EPT functionality as a temporary workaround until a patch is available. Restrict access to the VMCS fields to minimize the risk of exploitation.

Correção

DoS

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-399

Identificadores relacionados

CVE-2010-2938
RHSA-2010:0723
RHSA-2010_0723

Produtos afetados

Linux Kernel
Red Hat
Xen