Executive brief
A vulnerability in the Xen hypervisor, which is software used to run multiple virtual machines on a single physical server, could allow a user on a guest virtual machine to crash the entire host system. This issue specifically affects servers using AMD processors. An exploit would result in a total service outage for all virtual machines running on that physical hardware, though it does not allow for data theft.
Technical details
A NULL pointer dereference vulnerability exists in Xen versions 4.6.x through 4.8.x during the emulation of the Intel VMX VMFUNC leaf 0 instruction. While the hvmemul_vmfunc function pointer was introduced for Intel hardware, the pointer remains NULL on AMD SVM hardware. The hypervisor fails to perform a NULL check before an indirect function call at the call site. A local attacker with privileges in an HVM guest can trigger this missing check to cause a hypervisor panic, leading to a denial of service. This issue only affects HVM guests running on AMD x86 hardware; PV guests and Intel-based systems are not impacted. Patches are available from the Xen Project (XSA-203).
Affected products
- Xen Project Xen 4.6.x through 4.8.x
- Citrix XenServer 6.0.2, 6.2.0, 6.5, 7.0
Timeline
- 2016-12-21: advisory: Xen Project released XSA-203
- 2016-12-21: patched
- 2017-01-26: disclosed: NVD publication date