FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

xen-tools -- cirrus_bitblt_cputovideo does not check if memory region is safe

Affected packages
		xen-tools	<	4.7.1_4

Details

VuXML ID	8cbd9c08-f8b9-11e6-ae1b-002590263bf5
Discovery	2017-02-21
Entry	2017-02-22

The Xen Project reports:

In CIRRUS_BLTMODE_MEMSYSSRC mode the bitblit copy routine cirrus_bitblt_cputovideo fails to check whether the specified memory region is safe. A malicious guest administrator can cause an out of bounds memory write, very likely exploitable as a privilege escalation.

[source]

References

CVE Name	CVE-2017-2620
URL	http://xenbits.xen.org/xsa/advisory-209.html