漏洞标题
N/A
漏洞描述信息
在Xen 4.12.x 版本中发现一个问题，该问题允许 x86 PV 虚拟机操作系统用户通过利用页面表晋升和降序操作中的竞态条件来获得主机操作系统权限。有可重启的 PV 类型更改操作的问题。为了避免为 PV 用户使用阴影页面表，Xen 将实际硬件页面表暴露给用户。为了阻止用户直接修改这些页面表，Xen 跟踪页面如何使用类型系统；页面必须在用作页面表之前进行“晋升”，并在用作其他类型之前进行“降序”。Xen 还允许进行“递归”晋升：例如，操作系统将一个页面晋升到 L4 页面表可能会导致页面晋升到 L3s，这可能会导致页面晋升到 L2s，然后继续如此等等。这些操作可能需要花费任意数量的时间，因此必须重新启动。然而，使递归页面表晋升和降序操作可重新启动极其复杂，代码中包含多个竞态条件，如果触发，可能导致 Xen 丢失或保留额外的类型计数，从而允许 guests 访问正在使用的页面表。恶意的 PV 虚拟机管理员可能能够将他们的权限升级到主机权限。所有具有未信任 PV 用户的 x86 系统都是 vulnerable。HVM 和 PVH 虚拟机无法利用此漏洞。
CVSS信息
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
漏洞类别
N/A
漏洞标题
N/A
漏洞描述信息
An issue was discovered in Xen through 4.12.x allowing x86 PV guest OS users to gain host OS privileges by leveraging race conditions in pagetable promotion and demotion operations. There are issues with restartable PV type change operations. To avoid using shadow pagetables for PV guests, Xen exposes the actual hardware pagetables to the guest. In order to prevent the guest from modifying these page tables directly, Xen keeps track of how pages are used using a type system; pages must be "promoted" before being used as a pagetable, and "demoted" before being used for any other type. Xen also allows for "recursive" promotions: i.e., an operating system promoting a page to an L4 pagetable may end up causing pages to be promoted to L3s, which may in turn cause pages to be promoted to L2s, and so on. These operations may take an arbitrarily large amount of time, and so must be re-startable. Unfortunately, making recursive pagetable promotion and demotion operations restartable is incredibly complicated, and the code contains several races which, if triggered, can cause Xen to drop or retain extra type counts, potentially allowing guests to get write access to in-use pagetables. A malicious PV guest administrator may be able to escalate their privilege to that of the host. All x86 systems with untrusted PV guests are vulnerable. HVM and PVH guests cannot exercise this vulnerability.
CVSS信息
N/A
漏洞类别
N/A
漏洞标题
Xen 竞争条件问题漏洞
漏洞描述信息
Xen是英国剑桥大学的一款开源的虚拟机监视器产品。该产品能够使不同和不兼容的操作系统运行在同一台计算机上，并支持在运行时进行迁移，保证正常运行并且避免宕机。 Xen 4.12.x及之前版本中存在安全漏洞。攻击者可利用该漏洞获取主机操作系统权限。
CVSS信息
N/A
漏洞类别
竞争条件问题