Improper access control in xen (Alpine package)

1) Improper access control

EUVDB-ID: #VU32260

Risk: Low

CVSSv4.0: 7.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/U:Clear]

CVE-ID: CVE-2016-6258

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

Description

The vulnerability allows a local authenticated user to execute arbitrary code.

The PV pagetable code in arch/x86/mm.c in Xen 4.7.x and earlier allows local 32-bit PV guest OS administrators to gain host OS privileges by leveraging fast-paths for updating pagetable entries.

Mitigation

Install update from vendor's website.

Vulnerable software versions

xen (Alpine package): 4.5.1-r6 - 4.7.6-r0

xen (Alpine package):

CPE2.3

• cpe:2.3:o:alpine:xen_alpine_package:4.5.1-r6:*:*:*:*:alpine_linux:*:3.1
• cpe:2.3:o:alpine:xen_alpine_package:4.6.3-r0:*:*:*:*:alpine_linux:*:3.3
• cpe:2.3:o:alpine:xen_alpine_package:4.7.0-r4:*:*:*:*:alpine_linux:*:3.5
• cpe:2.3:o:alpine:xen_alpine_package::*:*:*:*:alpine_linux:*:*

External links

https://git.alpinelinux.org/aports/commit/?id=a80b91506c3d39fd6d12fe94a65dd4a313261546
https://git.alpinelinux.org/aports/commit/?id=68368249e3421886c66d79df3bd184f6ff617041
https://git.alpinelinux.org/aports/commit/?id=59d51c1852e15d7d5e6d20ca1c5e19b137c2ea37
https://git.alpinelinux.org/aports/commit/?id=93cedf0264ea23d61efd07fa82126f2f9e375b20
https://git.alpinelinux.org/aports/commit/?id=d0a7fcca4e82f4ff531083fa762975ee6b0ec9f4

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.