Executive brief
A vulnerability in the Xen hypervisor, which is used to run multiple virtual machines on a single physical server, could allow a user inside a virtual machine to gain unauthorized control over that guest operating system. By exploiting a flaw in how the system handles memory segments, an unprivileged program could bypass security boundaries to gain administrative rights within the virtual environment. This could lead to unauthorized access to sensitive data or the disruption of services running on the affected virtual machine.
Technical details
The Xen x86 emulator erroneously fails to consider the 'unusable' attribute of segments when performing memory accesses. Specifically, while NULL selectors are intended to prevent access in 32-bit mode (and for LDT system segments in both 32/64-bit), the emulator may permit access using stale or unexpected base/limit values. On Intel hardware, loading a NULL selector zeros the base but sets the limit to its maximum; on AMD, it may leave stale base/limit values intact. An unprivileged guest user can exploit this logic error to bypass memory protections and escalate privileges to that of the guest kernel. The issue is restricted to HVM guests; PV guests and ARM-based systems are not affected. Patches are available for all supported Xen versions (XSA-191).
Affected products
- Xen Project Xen All versions; fixed in 4.7.1-r4, 4.6.x, 4.5.x, 4.4.x with patches
- Citrix XenServer 6.0.2, 6.2.0, 6.5, 7.0
Timeline
- 2016-11-22: advisory: Xen Project released XSA-191
- 2016-11-22: patched: Patches released for Xen unstable, 4.7.x, 4.6.x, 4.5.x, and 4.4.x
- 2017-01-23: disclosed: NVD publication date