x86: buffer overrun with shadow paging + tracing
Shadow mode tracing code uses a set of per-CPU variables to avoid
cumbersome parameter passing. Some of these variables are written to
with guest controlled data, of guest controllable size. That size can
be larger than the variable, and bounding of the writes was missing.
Metrics
| Version | Base score | Base severity | Vector |
|---|
Impacts
| CAPEC ID | Description |
|---|
| N/A | The exact effects depend on what's adjacent to the variables in
question. The most likely effects are bogus trace data, but none of
privilege escalation, information leaks, or Denial of Service (DoS) can
be excluded without detailed analysis of the particular build of Xen. |
CAPEC ID: N/A
Description: The exact effects depend on what's adjacent to the variables in
question. The most likely effects are bogus trace data, but none of
privilege escalation, information leaks, or Denial of Service (DoS) can
be excluded without detailed analysis of the particular build of Xen.