Actu
Vigil@nce - Xen: denial of service via Driver Domains
June 2016 by Vigil@nce
This bulletin was written by Vigil@nce : https://vigilance.fr/offer
SYNTHESIS OF THE VULNERABILITY
An attacker, who is located in a Xen Driver Domain, can create
malicious data for libxl, in order to trigger a denial of service
in administration features.
Impacted products: Xen.
Severity: 1/4.
Creation date: 02/06/2016.
Revision date: 07/06/2016.
DESCRIPTION OF THE VULNERABILITY
The Xen product uses Driver Domains which contain jailed hardware.
The libxl library, which is used for administration, can access to
Driver Domains data. However, it does not check if manipulated
data are correct.
An attacker, who is located in a Xen Driver Domain, can therefore
create malicious data for libxl, in order to trigger a denial of
service in administration features.
ACCESS TO THE COMPLETE VIGIL@NCE BULLETIN
https://vigilance.fr/vulnerability/Xen-denial-of-service-via-Driver-Domains-19767
