NULL pointer dereference in xen (Alpine package)

1) NULL pointer dereference

EUVDB-ID: #VU32258

Risk: Medium

CVSSv4.0: 3.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:U/U:Green]

CVE-ID: CVE-2016-5242

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error in arch/arm/p2m.c in Xen 4.4.x through 4.6.x allows local guest OS users with access to the driver domain to cause a denial of service (NULL pointer dereference and host OS crash) by creating concurrent domains and holding references to them, related to VMID exhaustion. <a href="http://cwe.mitre.org/data/definitions/476. A remote attacker can perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

xen (Alpine package): 4.4.1-r0 - 4.4.2-r7

CPE2.3

• cpe:2.3:o:alpine:xen_alpine_package:4.4.1-r0:*:*:*:*:alpine_linux:*:3.0
• cpe:2.3:o:alpine:xen_alpine_package:4.4.1-r6:*:*:*:*:alpine_linux:*:3.0
• cpe:2.3:o:alpine:xen_alpine_package:4.4.1-r7:*:*:*:*:alpine_linux:*:3.0

External links

https://git.alpinelinux.org/aports/commit/?id=39334b55a641271e04b6529e4ba75f780b232a6c
https://git.alpinelinux.org/aports/commit/?id=59d51c1852e15d7d5e6d20ca1c5e19b137c2ea37
https://git.alpinelinux.org/aports/commit/?id=4d9b1191d25346078292e15a72277491186551d1

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.