PT-2017-10100 · Xen+2 · Xen+2
Jan Beulich
·
Published
2016-11-25
·
Updated
2024-06-15
·
CVE-2016-9382
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Xen versions 4.0.x through 4.7.x
Description
The issue arises from the mishandling of x86 task switches to VM86 mode, allowing local 32-bit x86 HVM guest OS users to gain privileges or cause a denial of service, resulting in a guest OS crash. This can be achieved by leveraging a guest operating system that utilizes hardware task switching and permits a new task to initiate in VM86 mode.
Recommendations
For Xen versions 4.0.x through 4.7.x, consider disabling hardware task switching in the guest operating system to minimize the risk of exploitation until a patch is available. Restrict the use of VM86 mode in the guest OS to prevent privilege escalation or denial of service attacks.
Fix
DoS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Suse
Xen