Xen DR7 and CR4 Registers Multiple Local Denial of Service Vulnerabilities

Bugtraq ID:	27219
Class:	Design Error
CVE:	CVE-2007-5906 CVE-2007-5907
Remote:	No
Local:	Yes
Published:	Jan 10 2008 12:00AM
Updated:	Nov 05 2008 05:55PM
Credit:	Jan Beulich is credited with the discovery of these vulnerabilities.
Vulnerable:	XenSource Xen 3.1.2 XenSource Xen 3.1.1 XenSource Xen 3.0.3 XenSource Xen 3.0 SuSE SUSE Linux Enterprise Server 10 SuSE Linux Enterprise Server 10.SP1 SuSE Linux Enterprise Server 10 + Linux kernel 2.6.5 SuSE Linux 10.1 x86-64 SuSE Linux 10.1 x86 SuSE Linux 10.1 ppc S.u.S.E. openSUSE 10.3 S.u.S.E. openSUSE 10.2 S.u.S.E. Linux Professional 10.1 S.u.S.E. Linux Personal 10.1 Redhat Enterprise Linux Desktop 5 client Redhat Enterprise Linux 5 server
Not Vulnerable:

Xen DR7 and CR4 Registers Multiple Local Denial of Service Vulnerabilities

Xen is prone to multiple local denial-of-service vulnerabilities.

An attacker can exploit these issues to crash the hypervisor, triggering denial-of-service conditions for all hosted virtual machines.

Xen DR7 and CR4 Registers Multiple Local Denial of Service Vulnerabilities

Currently we are not aware of any working exploits for these issues. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Xen DR7 and CR4 Registers Multiple Local Denial of Service Vulnerabilities

Solution:
The vendor released updates to address these issues. Please see the references for more information.

Xen DR7 and CR4 Registers Multiple Local Denial of Service Vulnerabilities

References:

• [Xen-devel] [PATCH, fixed] x86: fix debug register handling (XenSource)
  
• [Xen-devel] [PATCH] x86: allow pv guests to disable TSC for applications (XenSource)
  
• Xen Project Homepage (Xen Project)