Input validation error in Xen

1) Input validation error

EUVDB-ID: #VU32790

Risk: Low

CVSSv4.0: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2006-0744

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a local non-authenticated attacker to perform a denial of service (DoS) attack.

Linux kernel before 2.6.16.5 does not properly handle uncanonical return addresses on Intel EM64T CPUs, which reports an exception in the SYSRET instead of the next instruction, which causes the kernel exception handler to run on the user stack with the wrong GS.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Xen: 4.24

CPE2.3

• cpe:2.3:a:xen_project:xen:4.24:*:*:*:*:*:*:*

External links

https://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.16.5
https://lwn.net/Alerts/180820/
https://secunia.com/advisories/19639
https://secunia.com/advisories/19735
https://secunia.com/advisories/20157
https://secunia.com/advisories/20237
https://secunia.com/advisories/20398
https://secunia.com/advisories/20716
https://secunia.com/advisories/20914
https://secunia.com/advisories/21136
https://secunia.com/advisories/21179
https://secunia.com/advisories/21498
https://secunia.com/advisories/21745
https://secunia.com/advisories/21983
https://support.avaya.com/elmodocs2/security/ASA-2006-161.htm
https://support.avaya.com/elmodocs2/security/ASA-2006-180.htm
https://www.debian.org/security/2006/dsa-1103
https://www.mandriva.com/security/advisories?name=MDKSA-2006:086
https://www.mandriva.com/security/advisories?name=MDKSA-2006:150
https://www.novell.com/linux/security/advisories/2006_42_kernel.html
https://www.novell.com/linux/security/advisories/2006_47_kernel.html
https://www.novell.com/linux/security/advisories/2006-05-31.html
https://www.osvdb.org/24639
https://www.redhat.com/support/errata/RHSA-2006-0437.html
https://www.redhat.com/support/errata/RHSA-2006-0493.html
https://www.securityfocus.com/bid/17541
https://www.ubuntu.com/usn/usn-302-1
https://www.vupen.com/english/advisories/2006/1390
https://www.vupen.com/english/advisories/2006/1475
https://www.vupen.com/english/advisories/2006/2554
https://exchange.xforce.ibmcloud.com/vulnerabilities/25869
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9732

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.