Vulnerabilities > CVE-2008-1943 - Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in Xensource XEN
Attack vector
LOCAL Attack complexity
LOW Privileges required
NONE Confidentiality impact
NONE Integrity impact
NONE Availability impact
PARTIAL Summary
Buffer overflow in the backend of XenSource Xen Para Virtualized Frame Buffer (PVFB) 3.0 through 3.1.2 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a crafted description of a shared framebuffer. Possible solution and more infomation located here: http://rhn.redhat.com/errata/RHSA-2008-0194.html
Vulnerable Configurations
Part | Description | Count |
---|---|---|
OS | 4 | |
Application | 5 |
Common Weakness Enumeration (CWE)
Common Attack Pattern Enumeration and Classification (CAPEC)
- Buffer Overflow via Environment Variables This attack pattern involves causing a buffer overflow through manipulation of environment variables. Once the attacker finds that they can modify an environment variable, they may try to overflow associated buffers. This attack leverages implicit trust often placed in environment variables.
- Overflow Buffers Buffer Overflow attacks target improper or missing bounds checking on buffer operations, typically triggered by input injected by an attacker. As a consequence, an attacker is able to write past the boundaries of allocated buffer regions in memory, causing a program crash or potentially redirection of execution as per the attackers' choice.
- Client-side Injection-induced Buffer Overflow This type of attack exploits a buffer overflow vulnerability in targeted client software through injection of malicious content from a custom-built hostile service.
- Filter Failure through Buffer Overflow In this attack, the idea is to cause an active filter to fail by causing an oversized transaction. An attacker may try to feed overly long input strings to the program in an attempt to overwhelm the filter (by causing a buffer overflow) and hoping that the filter does not fail securely (i.e. the user input is let into the system unfiltered).
- MIME Conversion An attacker exploits a weakness in the MIME conversion routine to cause a buffer overflow and gain control over the mail server machine. The MIME system is designed to allow various different information formats to be interpreted and sent via e-mail. Attack points exist when data are converted to MIME compatible format and back.
Nessus
NASL family CentOS Local Security Checks NASL id CENTOS_RHSA-2008-0194.NASL description Updated xen packages that fix several security issues and a bug are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. The xen packages contain tools for managing the virtual machine monitor in Red Hat Virtualization. These updated packages fix the following security issues : Daniel P. Berrange discovered that the hypervisor last seen 2020-06-01 modified 2020-06-02 plugin id 43678 published 2010-01-06 reporter This script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/43678 title CentOS 5 : xen (CESA-2008:0194) code #%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Red Hat Security Advisory RHSA-2008:0194 and # CentOS Errata and Security Advisory 2008:0194 respectively. # include("compat.inc"); if (description) { script_id(43678); script_version("1.15"); script_cvs_date("Date: 2019/10/25 13:36:04"); script_cve_id("CVE-2007-3919", "CVE-2007-5730", "CVE-2008-0928", "CVE-2008-1943", "CVE-2008-1944", "CVE-2008-2004"); script_bugtraq_id(23731); script_xref(name:"RHSA", value:"2008:0194"); script_name(english:"CentOS 5 : xen (CESA-2008:0194)"); script_summary(english:"Checks rpm output for the updated packages"); script_set_attribute( attribute:"synopsis", value:"The remote CentOS host is missing one or more security updates." ); script_set_attribute( attribute:"description", value: "Updated xen packages that fix several security issues and a bug are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. The xen packages contain tools for managing the virtual machine monitor in Red Hat Virtualization. These updated packages fix the following security issues : Daniel P. Berrange discovered that the hypervisor's para-virtualized framebuffer (PVFB) backend failed to validate the format of messages serving to update the contents of the framebuffer. This could allow a malicious user to cause a denial of service, or compromise the privileged domain (Dom0). (CVE-2008-1944) Markus Armbruster discovered that the hypervisor's para-virtualized framebuffer (PVFB) backend failed to validate the frontend's framebuffer description. This could allow a malicious user to cause a denial of service, or to use a specially crafted frontend to compromise the privileged domain (Dom0). (CVE-2008-1943) Chris Wright discovered a security vulnerability in the QEMU block format auto-detection, when running fully-virtualized guests. Such fully-virtualized guests, with a raw formatted disk image, were able to write a header to that disk image describing another format. This could allow such guests to read arbitrary files in their hypervisor's host. (CVE-2008-2004) Ian Jackson discovered a security vulnerability in the QEMU block device drivers backend. A guest operating system could issue a block device request and read or write arbitrary memory locations, which could lead to privilege escalation. (CVE-2008-0928) Tavis Ormandy found that QEMU did not perform adequate sanity-checking of data received via the 'net socket listen' option. A malicious local administrator of a guest domain could trigger this flaw to potentially execute arbitrary code outside of the domain. (CVE-2007-5730) Steve Kemp discovered that the xenbaked daemon and the XenMon utility communicated via an insecure temporary file. A malicious local administrator of a guest domain could perform a symbolic link attack, causing arbitrary files to be truncated. (CVE-2007-3919) As well, in the previous xen packages, it was possible for Dom0 to fail to flush data from a fully-virtualized guest to disk, even if the guest explicitly requested the flush. This could cause data integrity problems on the guest. In these updated packages, Dom0 always respects the request to flush to disk. Users of xen are advised to upgrade to these updated packages, which resolve these issues." ); # https://lists.centos.org/pipermail/centos-announce/2008-May/014903.html script_set_attribute( attribute:"see_also", value:"http://www.nessus.org/u?b79107ec" ); # https://lists.centos.org/pipermail/centos-announce/2008-May/014904.html script_set_attribute( attribute:"see_also", value:"http://www.nessus.org/u?58bc144c" ); script_set_attribute(attribute:"solution", value:"Update the affected xen packages."); script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C"); script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available"); script_set_attribute(attribute:"exploit_available", value:"false"); script_cwe_id(59, 119, 200, 264); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:xen"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:xen-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:xen-libs"); script_set_attribute(attribute:"cpe", value:"cpe:/o:centos:centos:5"); script_set_attribute(attribute:"vuln_publication_date", value:"2007/10/28"); script_set_attribute(attribute:"patch_publication_date", value:"2008/05/15"); script_set_attribute(attribute:"plugin_publication_date", value:"2010/01/06"); script_set_attribute(attribute:"generated_plugin", value:"current"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"CentOS Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/CentOS/release", "Host/CentOS/rpm-list"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/CentOS/release"); if (isnull(release) || "CentOS" >!< release) audit(AUDIT_OS_NOT, "CentOS"); os_ver = pregmatch(pattern: "CentOS(?: Linux)? release ([0-9]+)", string:release); if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "CentOS"); os_ver = os_ver[1]; if (! preg(pattern:"^5([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "CentOS 5.x", "CentOS " + os_ver); if (!get_kb_item("Host/CentOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "CentOS", cpu); flag = 0; if (rpm_check(release:"CentOS-5", reference:"xen-3.0.3-41.el5_1.5")) flag++; if (rpm_check(release:"CentOS-5", reference:"xen-devel-3.0.3-41.el5_1.5")) flag++; if (rpm_check(release:"CentOS-5", reference:"xen-libs-3.0.3-41.el5_1.5")) flag++; if (flag) { security_report_v4( port : 0, severity : SECURITY_HOLE, extra : rpm_report_get() ); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "xen / xen-devel / xen-libs"); }
NASL family Scientific Linux Local Security Checks NASL id SL_20080513_XEN_ON_SL5_X.NASL description Note: Troy Dawson has tested this update on a machine hosting both paravirtualized and fully virtualized machines, both 32 bit and 64 bit. He did the update while all the machines were running, none of them had any problems. He also tried stopping, starting, and rebooting several of the machines. All without any problems. We tell you this because updating the xen package, while running virtual machines, can make you a little nervous. These updated packages fix the following security issues : Daniel P. Berrange discovered that the hypervisor last seen 2020-06-01 modified 2020-06-02 plugin id 60398 published 2012-08-01 reporter This script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/60398 title Scientific Linux Security Update : xen on SL5.x i386/x86_64 NASL family OracleVM Local Security Checks NASL id ORACLEVM_OVMSA-2008-2007.NASL description The remote OracleVM system is missing necessary patches to address critical security updates : - CVE-2008-1945: add image format options for USB storage and removable media - CVE-2008-1952: included in fix for CVE-2008-1943 (3.1.4-0.1.3.el5) last seen 2020-06-01 modified 2020-06-02 plugin id 79449 published 2014-11-26 reporter This script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/79449 title OracleVM 2.1 : xen (OVMSA-2008-2007) NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2008-0194.NASL description Updated xen packages that fix several security issues and a bug are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. The xen packages contain tools for managing the virtual machine monitor in Red Hat Virtualization. These updated packages fix the following security issues : Daniel P. Berrange discovered that the hypervisor last seen 2020-06-01 modified 2020-06-02 plugin id 32354 published 2008-05-16 reporter This script is Copyright (C) 2008-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/32354 title RHEL 5 : xen (RHSA-2008:0194) NASL family Oracle Linux Local Security Checks NASL id ORACLELINUX_ELSA-2008-0194.NASL description From Red Hat Security Advisory 2008:0194 : Updated xen packages that fix several security issues and a bug are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. The xen packages contain tools for managing the virtual machine monitor in Red Hat Virtualization. These updated packages fix the following security issues : Daniel P. Berrange discovered that the hypervisor last seen 2020-06-01 modified 2020-06-02 plugin id 67671 published 2013-07-12 reporter This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/67671 title Oracle Linux 5 : xen (ELSA-2008-0194)
Oval
accepted | 2013-04-29T04:04:47.832-04:00 | ||||||||||||
class | vulnerability | ||||||||||||
contributors |
| ||||||||||||
definition_extensions |
| ||||||||||||
description | Buffer overflow in the backend of XenSource Xen Para Virtualized Frame Buffer (PVFB) 3.0 through 3.1.2 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a crafted description of a shared framebuffer. | ||||||||||||
family | unix | ||||||||||||
id | oval:org.mitre.oval:def:10338 | ||||||||||||
status | accepted | ||||||||||||
submitted | 2010-07-09T03:56:16-04:00 | ||||||||||||
title | Buffer overflow in the backend of XenSource Xen Para Virtualized Frame Buffer (PVFB) 3.0 through 3.1.2 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a crafted description of a shared framebuffer. | ||||||||||||
version | 18 |
Redhat
advisories |
| ||||
rpms |
|
Seebug
bulletinFamily | exploit |
description | BUGTRAQ ID: 29183 CVE(CAN) ID: CVE-2008-1943 Xen是可用于Linux内核的一种虚拟化技术,允许同时运行多个操作系统。 Xen中超虚拟化帧缓冲区(PVFB)后端没有验证前端的帧缓冲区描述,这可能允许恶意用户导致拒绝服务或使用特制的前端入侵特权域Dom0。 帧缓冲区是由以下参数描述的: * fb_len(共享帧缓冲区大小) * width,height,depth * row_stride,offset 在启动时fb_len是固定大小,前端可以通过发送XENFB_TYPE_RESIZE事件修改其他参数。如果存在后端配置参数videoram的话,xenfb_read_frontend_fb_config()会根据这个参数限制fb_len。xenfb_map_fb()使用fb_len映射前端的帧缓冲区,除非有videoram参数的限制,否则前端就可以使该函数映射任意大小。 xenfb_register_console()和xenfb_on_fb_event()向QEMU的DisplayState对象传送width、height、depth和rowstride参数。如果参数允许的话,DisplayState对象直接操作帧缓冲区(shared_buf为true),否则分配大小为height * width * depth/8的内部缓冲区(shared_buf为false)。 xenfb_on_fb_event()使用width和height参数确定升级事件的区域,然后将该区域传送给xenfb_guest_copy();xenfb_invalidate()将完整的屏幕区域传送给xenfb_guest_copy();除非shared_buf为true,否则xenfb_guest_copy()将参数区域(x,y,w,h)拷贝到内部缓冲区,这会拷贝h块内存;从0开始计算的第i次拷贝将共享帧缓冲区的w * depth/8字节 + offset + (y + i) * row_stride + x * depth/8拷贝到了内部缓冲区 + (y + i) * ds->linesize + x * ds->depth/8。(这里ds->linesize和ds->depth是后端所指定的内部缓冲区) 上述拷贝操作会导致读取读取共享的帧缓冲区并越界写入到内部缓冲区。前端可以利用这个漏洞写入到任意后端内存,导致拒绝服务或入侵特权域。 XenSource Xen 3.2.1 RedHat ------ RedHat已经为此发布了一个安全公告(RHSA-2008:0194-01)以及相应补丁: RHSA-2008:0194-01:Important: xen security and bug fix update 链接:<a href=https://www.redhat.com/support/errata/RHSA-2008-0194.html target=_blank>https://www.redhat.com/support/errata/RHSA-2008-0194.html</a> 补丁下载: XenSource --------- 目前厂商已经发布了升级补丁以修复这个安全问题,请到厂商的主页下载: <a href=http://xenbits.xensource.com/xen-unstable.hg?diff/53195719f762/tools/ioemu/hw/xenfb.c target=_blank>http://xenbits.xensource.com/xen-unstable.hg?diff/53195719f762/tools/ioemu/hw/xenfb.c</a> <a href=http://xenbits.xensource.com/xen-unstable.hg?diff/9044705960cb/tools/ioemu/hw/xenfb.c target=_blank>http://xenbits.xensource.com/xen-unstable.hg?diff/9044705960cb/tools/ioemu/hw/xenfb.c</a> |
id | SSV:3473 |
last seen | 2017-11-19 |
modified | 2008-06-25 |
published | 2008-06-25 |
reporter | Root |
title | Xen超虚拟化帧缓冲区后端帧缓冲区处理漏洞 |
References
- http://secunia.com/advisories/29963
- http://secunia.com/advisories/30781
- http://www.redhat.com/support/errata/RHSA-2008-0194.html
- http://www.securityfocus.com/bid/29183
- http://www.securitytracker.com/id?1020008
- http://www.vupen.com/english/advisories/2008/1900/references
- https://bugzilla.redhat.com/show_bug.cgi?id=443078
- https://exchange.xforce.ibmcloud.com/vulnerabilities/42387
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10338