PT-2012-1675 · Citrix+1 · Xen+1

Tim Deegan · Published 2011-10-20 · Updated 2012-12-13 · CVE-2011-3131

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Xen versions prior to 4.1.1

Description The issue allows local guest OS kernels with control of a PCI[E] device to cause a denial of service, resulting in CPU consumption and host hang. This is achieved by sending many crafted DMA requests that are denied by the IOMMU, triggering a livelock.

Recommendations For versions prior to 4.1.1, update to a version that contains a fix for this issue to prevent local guest OS kernels from causing a denial of service.

Exploit

Fix

DoS

Weakness Enumeration

CWE-399

Related Identifiers

CVE-2011-3131

DSA-2582-1

RHSA-2011:1386

RHSA-2011_1386

Affected Products

Red Hat

Xen

References · 41

• 🔥 http://xenbits.xen.org/hg/staging/xen-4.1-testing.hg/rev/84e3706df07a · Exploit
• http://secunia.com/advisories/51468 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-04437 · Security Note
• https://bdu.fstec.ru/vul/2015-04439 · Security Note
• https://bdu.fstec.ru/vul/2015-04607 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2011-3131 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-3131 · Security Note
• https://bdu.fstec.ru/vul/2015-04359 · Security Note
• http://debian.org/security/2012/dsa-2582 · Vendor Advisory
• http://secunia.com/advisories/45622 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2011-3131 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2011-3131 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-04438 · Security Note
• https://github.com/torvalds/linux/commit/764355487ea220fdc2faf128d577d7f679b91f97 · Note
• https://github.com/torvalds/linux/commit/4ff67b720c02c36e54d55b88c2931879b7db1cd2 · Note