Detections
Analytics

FreeBSD : xen-kernel -- GNTTABOP_swap_grant_ref operation misbehavior (80e846ff-27eb-11e5-a4a5-002590263bf5)

medium Nessus Plugin ID 84706

Language:

Synopsis

The remote FreeBSD host is missing a security-related update.

Description

The Xen Project reports :

With the introduction of version 2 grant table operations, a version check became necessary for most grant table related hypercalls. The GNTTABOP_swap_grant_ref call was lacking such a check. As a result, the subsequent code behaved as if version 2 was in use, when a guest issued this hypercall without a prior GNTTABOP_setup_table or GNTTABOP_set_version.

The effect is a possible NULL pointer dereferences. However, this cannot be exploited to elevate privileges of the attacking domain, as the maximum memory address that can be wrongly accessed this way is bounded to far below the start of hypervisor memory.

Malicious or buggy guest domain kernels can mount a denial of service attack which, if successful, can affect the whole system.

Solution

Update the affected package.

See Also

http://xenbits.xen.org/xsa/advisory-134.html

http://www.nessus.org/u?f8c2818a

Plugin Details

Severity: Medium

ID: 84706

File Name: freebsd_pkg_80e846ff27eb11e5a4a5002590263bf5.nasl

Version: 2.4

Type: local

Published: 7/14/2015

Updated: 1/6/2021

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.0

CVSS v2

Risk Factor: Medium

Base Score: 4.9

Vector: CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C

Vulnerability Information

CPE: p-cpe:/a:freebsd:freebsd:xen-kernel, cpe:/o:freebsd:freebsd

Required KB Items: Host/local_checks_enabled, Host/FreeBSD/release, Host/FreeBSD/pkg_info

Patch Publication Date: 7/11/2015

Vulnerability Publication Date: 6/11/2015

Reference Information

CVE: CVE-2015-4163