Vulnerability in Citrix XenServer Could Result in Information Disclosure
パッチも出てたので更新しておきました。XenServer6.2 SP1 のパッチリスト (2015/8/20 時点)
XenServer 6.2 (clearwater) と XenServer 6.5 (Creedence) を中心に雑な感じで書いていきます。といいながら、すでにXenServer7.2がリリースされている・・・
xe vm-param-list uuid=***************で確認したら、
PV-bootloader ( RW): eliloader
xe vm-param-set uuid=*************** PV-bootloader=pygrubで無事に起動。
When unplugging an emulated block device the device was not fully
unplugged, meaning a second unplug attempt would attempt to unplug the
device a second time using a previously freed pointer.
An HVM guest which has access to an emulated IDE disk device may be
able to exploit this vulnerability in order to take over the qemu
process elevating its privilege to that of the qemu process.
The QEMU model of the RTL8139 network card did not sufficiently
validate inputs in the C+ mode offload emulation. This results in
uninitialised memory from the QEMU process's heap being leaked to the
domain as well as to the network.
A guest may be able to read sensitive host-level data relating to
itself which resides in the QEMU process.
Such information may include things such as information relating to
real devices backing emulated devices or passwords which the host
administrator does not intend to share with the guest admin.