CVE-2017-7995

Xen PV guest anterior a Xen 4.3 chequea los permisos de acceso a los rangos MMIO sólo después de acceder a ellos, lo que permite leer en un dispositivo de memoria PCI, dando lugar a la divulgación de información. Se trata de un error en la función get_user. NOTA: el upstream Xen Project considera versiones anteriores a 4.5.x para ser EOL.

An update that solves four vulnerabilities and has three fixes is now available. This update for xen fixes several security issues. Allowing for all of privilege escalation, host crashes, and information leaks by placing a IRET hypercall in the middle of a multicall batch allowing for all of privilege escalation, host crashes, and information leaks because of a missing check when transfering pages via GNTTABOP_transfer. Hw/display/cirrus_vga_rop.h allowed local guest OS privileged users to cause a denial of service (out-of-bounds read and QEMU process crash) via vectors related to copying VGA data via the cirrus_bitblt_rop_fwd_transp_ and cirrus_bitblt_rop_fwd_ functions. A privileged user within the guest VM could have caused a heap overflow in the device model process, potentially escalating their privileges to that of the device model process.