Executive brief
A vulnerability in the Xen hypervisor, which is used to run multiple virtual machines on a single physical server, could allow a user inside a virtual machine to gain unauthorized control over that guest's operating system. On certain hardware, this could also be used to crash the virtual machine, leading to a denial of service. This issue specifically affects older 32-bit virtual machines using specific legacy hardware features.
Technical details
The vulnerability exists in the way Xen handles x86 hardware task switches when transitioning to VM86 mode. Specifically, the hypervisor failed to follow protected mode semantics for loading the Local Descriptor Table Register (LDTR) during these switches. A local unprivileged user within a 32-bit x86 HVM guest can exploit this flaw if the guest OS utilizes hardware task switching and permits tasks to start in VM86 mode. On AMD (SVM) hardware, this can lead to privilege escalation to the guest kernel level; on both Intel (VMX) and AMD hardware, it can result in a guest crash. PV guests and 64-bit guests are not affected. Patches are available via XSA-192.
Affected products
- Xen Project Xen 4.0.x through 4.7.x
- Citrix XenServer 6.0.2, 6.2.0, 6.5, 7.0
Timeline
- 2016-11-22: advisory: XSA-192 published by Xen Project Security Team
- 2016-11-22: patched: Patches released for affected Xen versions
- 2017-01-23: disclosed: NVD publication date