FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

xen-tools -- qemu incautious about shared ring processing

Affected packages
xen-tools < 4.7.1

Details

VuXML ID 58685e23-ba4d-11e6-ae1b-002590263bf5
Discovery 2016-11-22
Entry 2016-12-04

The Xen Project reports:

The compiler can emit optimizations in qemu which can lead to double fetch vulnerabilities. Specifically data on the rings shared between qemu and the hypervisor (which the guest under control can obtain mappings of) can be fetched twice (during which time the guest can alter the contents) possibly leading to arbitrary code execution in qemu.

Malicious administrators can exploit this vulnerability to take over the qemu process, elevating its privilege to that of the qemu process.

In a system not using a device model stub domain (or other techniques for deprivileging qemu), malicious guest administrators can thus elevate their privilege to that of the host.

References

CVE Name CVE-2016-9381
FreeBSD PR ports/214936
URL https://xenbits.xen.org/xsa/advisory-197.html