Description
Xen 3.x, possibly before 3.1.2, when running on IA64 systems, does not check the RID value for mov_to_rr, which allows a VTi domain to read memory of other domains.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | kernel +12 | 2.6.18-53.1.14.el5 | RHSA-2008:0154 |
Advisories 1
- RHSA-2008:0154 Red Hat Security Advisory: kernel security and bug fix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- 41341 vdb-entry
- RHSA-2008:0154 vendor-advisory
- http://lists.xensource.com/archives/html/xen-announce/2007-11/msg00000.html
- 27915 third-party-advisory
- 29236 third-party-advisory
- oval:org.mitre.oval:def:9471 vdb-entry signature
- 20071021 [Xen-ia64-devel] PATCH: check r2 value for VTi mov rr[r3]=r2 mailing-list
- 26716 vdb-entry