x86: memory leak with MSR emulation

2018-01-0412:00:00

Xen Project

xenbits.xen.org

502

4.9 Medium

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:N/I:N/A:C

6.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

0.001 Low

EPSS

Percentile

25.1%

JSON

ISSUE DESCRIPTION

In Xen 4.10, new infrastructure was introduced as part of an overhaul to how MSR emulation happens for guests. Unfortunately, one tracking structure isn’t freed when a vcpu is destroyed.

IMPACT

A memory allocation of 8 bytes is leaked each time a vcpu is destroyed.
A malicious guest may, by frequently rebooting over extended periods of time, run the system out of memory, resulting in a Denial of Service (DoS).

VULNERABLE SYSTEMS

Xen versions 4.10 and later are affected. Xen 4.9 and earlier are not affected.
Only x86 systems are affected. ARM systems are not.
All guest kinds can exploit this vulnerability.