Description
arch/x86/hvm/vmx/vmcs.c in the virtual-machine control structure (VMCS) implementation in the Linux kernel 2.6.18 on Red Hat Enterprise Linux (RHEL) 5, when an Intel platform without Extended Page Tables (EPT) functionality is used, accesses VMCS fields without verifying hardware support for these fields, which allows local users to cause a denial of service (host OS crash) by requesting a VMCS dump for a fully virtualized Xen guest.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | xen | 4.0.1-1 | — |
| Debian 13 | xen | 4.0.1-1 | — |
| Debian 12 | xen | 4.0.1-1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | kernel +12 | 2.6.18-194.17.1.el5 | RHSA-2010:0723 |
Advisories 1
- RHSA-2010:0723 Red Hat Security Advisory: kernel security and bug fix update Red Hat Security Advisories (RHSA) · Jun 28, 2026
References
- RHSA-2010:0723 vendor-advisory
- 20111013 VMSA-2011-0012 VMware ESXi and ESX updates to third party libraries and ESX Service Console mailing-list
- 43578 vdb-entry
- 46397 third-party-advisory
- http://xenbits.xensource.com/xen-unstable.hg?rev/15911
- http://www.vmware.com/security/advisories/VMSA-2011-0012.html
- http://support.avaya.com/css/P8/documents/100113326
- https://bugzilla.redhat.com/show_bug.cgi?id=620490