FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

xen-tools -- Potential unintended writes to host MSI message data field via qemu

Affected packages
3.3 <= xen-tools < 4.5.0_6

Details

VuXML ID af38cfec-27e7-11e5-a4a5-002590263bf5
Discovery 2015-06-02
Entry 2015-07-11

The Xen Project reports:

Logic is in place to avoid writes to certain host config space fields when the guest must nevertheless be able to access their virtual counterparts. A bug in how this logic deals with accesses spanning multiple fields allows the guest to write to the host MSI message data field.

While generally the writes write back the values previously read, their value in config space may have got changed by the host between the qemu read and write. In such a case host side interrupt handling could become confused, possibly losing interrupts or allowing spurious interrupt injection into other guests.

Certain untrusted guest administrators may be able to confuse host side interrupt handling, leading to a Denial of Service.

References

CVE Name CVE-2015-4103
URL http://xenbits.xen.org/xsa/advisory-128.html