Vulnerability of Xen: privilege elevation via QEMU Monitor

Synthesis of the vulnerability

An administrator of a guest system can use a keyboard shortcut, in order to access to the QEMU Monitor console, so he can elevate his privileges on the host.

Vulnerable products: Debian, Fedora, openSUSE, SUSE Linux Enterprise Desktop, SLES, Unix (platform) ~ not comprehensive.

Severity of this weakness: 2/4.

Creation date: 07/09/2012.

Références of this bulletin: BID-55442, CERTA-2012-AVI-490, CVE-2012-4411, DSA-2543-1, FEDORA-2012-13434, FEDORA-2012-13443, openSUSE-SU-2012:1572-1, openSUSE-SU-2012:1573-1, SUSE-SU-2012:1486-1, SUSE-SU-2012:1487-1, SUSE-SU-2012:1503-1, SUSE-SU-2014:0446-1, VIGILANCE-VUL-11922.

Description of the vulnerability

The QEMU Monitor console is used to:
- obtain information on devices
- change the configuration
- etc.

This console is reachable using keys CTRL and ALT. However, this keyboard shortcut is not disabled from guest systems, which have a graphical console.

An administrator of a guest system can therefore use a keyboard shortcut, in order to access to the QEMU Monitor console, so he can elevate his privileges on the host.
Full bulletin, software filtering, emails, fixes, ... (Request your free trial)

This threat alert impacts software or systems such as Debian, Fedora, openSUSE, SUSE Linux Enterprise Desktop, SLES, Unix (platform) ~ not comprehensive.

Our Vigil@nce team determined that the severity of this computer vulnerability bulletin is medium.

The trust level is of type confirmed by the editor, with an origin of user shell.

A proof of concept or an attack tool is available, so your teams have to process this alert. An attacker with a technician ability can exploit this weakness note.

Solutions for this threat

Xen: version 4.1.4.
The version 4.1.4 is fixed:
http://xen.org/download/index_4.1.4.html
Note: according to the announce, this version takes into account all vulnerabilities which have been announced on December, 03, 2012 except VIGILANCE-VUL-12206.

Xen: patch for QEMU Monitor.
A patch is available in information sources.

Debian: new xen-qemu-dm-4.0 packages.
New packages are available:
xen-qemu-dm-4.0 4.0.1-2+squeeze2

Fedora: new xen packages.
New packages are available:
xen-4.1.3-2.fc16
xen-4.1.3-4.fc17

openSUSE 12: new xen packages.
New packages are available:
openSUSE 12.1: xen-4.1.3_04-1.21.1
openSUSE 12.2: xen-4.1.3_04-5.13.1

SUSE LE 10: new xen packages (16/11/2012).
New packages are available:
xen-3.2.3_17040_42-0.7.2

SUSE LE 11: new libvirt packages.
New packages are available:
libvirt-0.9.6-0.23.1

SUSE LE 11: new xen packages.
New packages are available:
xen-4.1.3_04-0.5.1

SUSE LE 11 SP1: new xen packages.
New packages are available:
SUSE LE 11: xen 4.0.3_21548_16-0.5.1
Full bulletin, software filtering, emails, fixes, ... (Request your free trial)

Computer vulnerabilities tracking service

Vigil@nce provides a computer vulnerability note. The Vigil@nce vulnerability database contains several thousand vulnerabilities.