|
|
| |
|
| |
xen: multiple vulnerabilities
| Package(s): | xen |
CVE #(s): | CVE-2008-1945
CVE-2008-1952
|
| Created: | October 2, 2008 |
Updated: | May 13, 2009 |
| Description: |
From the Red Hat alert:
It was discovered that the hypervisor's para-virtualized framebuffer (PVFB)
backend failed to validate the frontend's framebuffer description properly.
This could allow a privileged user in the unprivileged domain (DomU) to
cause a denial of service, or, possibly, elevate privileges to the
privileged domain (Dom0). (CVE-2008-1952)
A flaw was found in the QEMU block format auto-detection, when running
fully-virtualized guests and using Qemu images written on removable media
(USB storage, 3.5" disks). Privileged users of such fully-virtualized
guests (DomU), with a raw-formatted disk image, were able to write a header
to that disk image describing another format. This could allow such guests
to read arbitrary files in their hypervisor's host (Dom0). (CVE-2008-1945) |
| Alerts: |
|
( Log in to post comments)
|
|
|