add-to-physmap error paths fail to release lock on ARM

2017-08-2315:16:00

Xen Project

xenbits.xen.org

528

4.9 Medium

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:N/I:N/A:C

6 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H

0.001 Low

EPSS

Percentile

20.8%

JSON

ISSUE DESCRIPTION

When dealing with the grant map space of add-to-physmap operations, ARM specific code recognizes a number of error conditions, but fails to release a lock being held on the respective exit paths.

IMPACT

A malicious guest administrator can cause a denial of service. Specifically, prevent use of a physical CPU for an indefinite period of time.

VULNERABLE SYSTEMS

Xen versions 4.4 and later are vulnerable. Xen versions 4.3 and earlier are not vulnerable.
Only ARM systems are affected. X86 systems are not affected.