CVE-2010-3699

Publication date 8 December 2010

Last updated 24 July 2024

Ubuntu priority

Medium

Why this priority?

The backend driver in Xen 3.x allows guest OS users to cause a denial of service via a kernel thread leak, which prevents the device and guest OS from being shut down or create a zombie domain, causes a hang in zenwatch, or prevents unspecified xm commands from working properly, related to (1) netback, (2) blkback, or (3) blktap.

From the Ubuntu Security Team

It was discovered that Xen did not correctly clean up threads. A local attacker in a guest system could exploit this to exhaust host system resources, leading to a denial of serivce.

Read the notes from the security team

Status

Package Ubuntu Release Status
linux 10.10 maverick
Not affected
10.04 LTS lucid
Not affected
9.10 karmic
Not affected
8.04 LTS hardy
Fixed 2.6.24-28.86
6.06 LTS dapper Not in release
linux-ec2 10.10 maverick Ignored end of life
10.04 LTS lucid
Not affected
9.10 karmic
Not affected
8.04 LTS hardy Not in release
6.06 LTS dapper Not in release
linux-lts-backport-maverick 10.10 maverick Not in release
10.04 LTS lucid
Not affected
9.10 karmic Not in release
8.04 LTS hardy Not in release
6.06 LTS dapper Not in release
linux-mvl-dove 10.10 maverick
Not affected
10.04 LTS lucid
Not affected
9.10 karmic Ignored end of life
8.04 LTS hardy Not in release
6.06 LTS dapper Not in release
linux-source-2.6.15 10.10 maverick Not in release
10.04 LTS lucid Not in release
9.10 karmic Not in release
8.04 LTS hardy Not in release
6.06 LTS dapper
Not affected
linux-ti-omap4 10.10 maverick
Not affected
10.04 LTS lucid Not in release
9.10 karmic Not in release
8.04 LTS hardy Not in release
6.06 LTS dapper Not in release

Notes

kees

The vulnerability described by CVE-2010-3699 probably exists, but I've not been able to reproduce it. It likely requires more block and network devices then I have at my disposal. Checked out http://xenbits.xensource.com/linux-2.6.18-xen.hg and compared. Not all of the original upstream patch was appropriate since it caused a regression with udev.

References

Related Ubuntu Security Notices (USN)

    • USN-1072-1
    • Linux kernel vulnerabilities
    • 25 February 2011

Other references