Resource exhaustion in xen (Alpine package)

1) Resource exhaustion

EUVDB-ID: #VU32259

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2016-5403

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

Description

The vulnerability allows a local authenticated user to perform a denial of service (DoS) attack.

The virtqueue_pop function in hw/virtio/virtio.c in QEMU allows local guest OS administrators to cause a denial of service (memory consumption and QEMU process crash) by submitting requests without waiting for completion.

Mitigation

Install update from vendor's website.

Vulnerable software versions

xen (Alpine package): 4.4.2-r7 - 4.7.6-r0

xen (Alpine package):

CPE2.3

• cpe:2.3:o:alpine:xen_alpine_package:4.4.2-r7:*:*:*:*:alpine_linux:*:3.1
• cpe:2.3:o:alpine:xen_alpine_package:4.5.1-r6:*:*:*:*:alpine_linux:*:3.2
• cpe:2.3:o:alpine:xen_alpine_package:4.6.3-r0:*:*:*:*:alpine_linux:*:3.3
• cpe:2.3:o:alpine:xen_alpine_package::*:*:*:*:alpine_linux:*:*

External links

https://git.alpinelinux.org/aports/commit/?id=68368249e3421886c66d79df3bd184f6ff617041
https://git.alpinelinux.org/aports/commit/?id=39334b55a641271e04b6529e4ba75f780b232a6c
https://git.alpinelinux.org/aports/commit/?id=59d51c1852e15d7d5e6d20ca1c5e19b137c2ea37
https://git.alpinelinux.org/aports/commit/?id=93cedf0264ea23d61efd07fa82126f2f9e375b20
https://git.alpinelinux.org/aports/commit/?id=d0a7fcca4e82f4ff531083fa762975ee6b0ec9f4

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.