Intel VT-d chipset Local Privilege Escalation Vulnerability for multiple virtualization applications

Release date:
Updated on:

Affected Systems:
RedHat Fedora 15
RedHat Fedora 14
XenSource Xen
Qumranet KVM
Description:
--------------------------------------------------------------------------------
Bugtraq id: 48515
Cve id: CVE-2011-1898

Intel VT-d is Intel's virtual allocation technology. It expands the virtualization technology development blueprint by providing hardware assistance for virtualization solutions. VT-d not only continues to support Virtualization of IA-32 (VT-x) and Intel & reg; anteng & reg; processor (VT-I, it also provides new virtualization support for I/O devices.

Multiple virtualization applications, such as Intel VT-d, have the local permission Escalation Vulnerability. Local attackers can exploit this vulnerability to gain elevated permissions in the client operating system and then control the host operating system, it can also trigger a denial of service.

When interrupt re ing is not enabled in the chipset, the Intel VT-d chipset allows clients with PCI devices to generate MSI interruptions by writing interrupt injection registers using DMA. This can be exploited to inject traps and control hosts.

<* Source: Rafal Wojtczuk

Link: http://xen.1045712.n5.nabble.com/Xen-security-advisory-CVE-2011-1898-VT-d-PCI-passthrough-MSI-td4390298.html
*>

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

Qumranet
--------
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:

Http://kvm.qumranet.com/kvmwiki/Front_Page