Description
The do_physdev_op function in Xen 4.1.5, 4.1.6.1, 4.2.2 through 4.2.3, and 4.3.x does not properly restrict access to the (1) PHYSDEVOP_prepare_msix and (2) PHYSDEVOP_release_msix operations, which allows local PV guests to cause a denial of service (host or guest malfunction) or possibly gain privileges via unspecified vectors.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | xen | 4.4.0-1 | — |
| Debian 13 | xen | 4.4.0-1 | — |
| Debian 12 | xen | 4.4.0-1 | — |
References
- 102536 vdb-entry
- 65125 vdb-entry
- xen-cve20141666-priv-esc(90675) vdb-entry
- SUSE-SU-2014:0373 vendor-advisory
- FEDORA-2014-1552 vendor-advisory
- http://support.citrix.com/article/CTX200288
- GLSA-201407-03 vendor-advisory
- FEDORA-2014-1559 vendor-advisory
- [oss-security] 20140123 Xen Security Advisory 87 (CVE-2014-1666) - PHYSDEVOP_{prepare,release}_msix exposed to unprivileged guests mailing-list
- 1029684 vdb-entry
- SUSE-SU-2014:0372 vendor-advisory
- http://xenbits.xen.org/xsa/advisory-87.html
- 56650 third-party-advisory
- http://xenbits.xen.org/xsa/xsa87-unstable-4.3.patch