Privilege escalation in Xen

1) Information disclosure

EUVDB-ID: #VU766

Risk: Low

CVSSv3.1: 4.6 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2016-7777

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

Description

The vulnerability allows a local unprivileged user to obtain potentially sensitive information on the guest system.
The weakness is caused by insufficient access control mechanisms. A local unprivileged user of a guest operating system can trigger the Xen instruction emulator by attempting to execute an invalid opcode and read or modify FPU, MMX, and XMM register state data of another process within the same guest system.
Successful exploitation of the vulnerability leads to register state information disclosure and corruption.

Mitigation

Update to version 5 or apply the following patches:

XSA-190 version 4.5.
http://xenbits.xen.org/xsa/xsa190-4.5.patch
XSA-190 version 4.6.
http://xenbits.xen.org/xsa/xsa190-4.6.patch

Vulnerable software versions

Xen: 4.4.0 - 4.7.0

Oracle VM Server for x86: 3.2 - 3.4

CPE2.3

• cpe:2.3:a:xen_project:xen:4.7.0:*:*:*:*:*:*:*
• cpe:2.3:a:xen_project:xen:4.6.3:*:*:*:*:*:*:*
• cpe:2.3:a:xen_project:xen:4.5.3:*:*:*:*:*:*:*
• cpe:2.3:a:oracle:oracle_vm_server_for_x86:3.4:*:*:*:*:*:*:*
• cpe:2.3:a:oracle:oracle_vm_server_for_x86:3.3:*:*:*:*:*:*:*
• cpe:2.3:a:oracle:oracle_vm_server_for_x86:3.2:*:*:*:*:*:*:*

External links

http://xenbits.xen.org/xsa/advisory-190.html
http://www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.html

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.