VDB-11493 · OSVDB 100854 · GCVE-100-11493

Linux Foundation Xen 4.3 Multiple Hypercall Implementations 弱身份验证

CVSS 元临时分数	当前攻击价格 (≈)	CTI兴趣分数
4.4	$0-$5k	0.00

摘要信息

检测到一个被分类为棘手的安全漏洞，影响Linux Foundation Xen 4.3。受此漏洞影响的是未知功能的组件Multiple Hypercall Implementations。在被操纵的情况下，会引发弱身份验证。没有可用的漏洞利用。

检测到一个被分类为棘手的安全漏洞，影响Linux Foundation Xen 4.3。受此漏洞影响的是未知功能的组件Multiple Hypercall Implementations。在被操纵的情况下，会引发弱身份验证。使用CWE来声明会导致 CWE-287 的问题。此漏洞的脆弱性 2013-12-10由公示人Jan Beulich and Don Slutz、公示人身份Xen Security Advisory 77 - Disaggregated domain management security status、公示人类型为Mailinglist Post (oss-sec)所提交。该安全通告已在 seclists.org 提供下载。与供应商合作公开发布。披露如下内容：

However the several affected hypercall implementations were originally written to be used only by the totally-privileged dom0, and have not been reviewed for security when exposed to supposedly-only-semi-privileged disaggregated management domains. But such management domains are (in such a design) to be seen as potentially hostile, e.g. due to privilege escalation following exploitation of a bug in the management domain. As a result, the potential security benefits of toolstack disaggregation are not always fully realised. This constitutes a breach of the enhanced security promises implied by the Xen APIs in Xen in 4.3 and later.

暂无技术细节。此漏洞的流行程度低于一般水平。没有可用的漏洞利用。现在，可能约为美元 $0-$5k。

若长度存在，则声明为未定义。该0day漏洞在地下市场的估算价格大约是$5k-$25k。