Description
The hvm_msr_read_intercept function in arch/x86/hvm/hvm.c in Xen 4.1 through 4.4.x uses an improper MSR range for x2APIC emulation, which allows local HVM guests to cause a denial of service (host crash) or read data from the hypervisor or other guests via unspecified vectors.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a n/a
n/aaffected
References
- http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00003.html ↗
- http://lists.fedoraproject.org/pipermail/package-announce/2014-October/140483.html ↗
- http://support.citrix.com/article/CTX201794 ↗
- http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00002.html ↗
- http://support.citrix.com/article/CTX200218 ↗
- http://lists.fedoraproject.org/pipermail/package-announce/2014-October/140199.html ↗
- http://www.c7zero.info/stuff/csw2017_ExploringYourSystemDeeper_updated.pdf ↗
- http://www.securitytracker.com/id/1030936 ↗
- http://xenbits.xen.org/xsa/advisory-108.html ↗
- http://lists.fedoraproject.org/pipermail/package-announce/2014-October/140418.html ↗
- http://secunia.com/advisories/61664 ↗
- http://www.debian.org/security/2014/dsa-3041 ↗
- http://secunia.com/advisories/61858 ↗
- http://secunia.com/advisories/61890 ↗
- http://security.gentoo.org/glsa/glsa-201412-42.xml ↗
- https://exchange.xforce.ibmcloud.com/vulnerabilities/96785 ↗
- http://www.securityfocus.com/bid/70198 ↗