CVE-2007-5498

Publication date 7 May 2008

Last updated 24 July 2024

Ubuntu priority

Low

Why this priority?

Description

The Xen hypervisor block backend driver for Linux kernel 2.6.18, when running on a 64-bit host with a 32-bit paravirtualized guest, allows local privileged users in the guest OS to cause a denial of service (host OS crash) via a request that specifies a large number of blocks.

From the Ubuntu Security Team

It was discovered that the Xen hypervisor block driver did not correctly validate requests. A user with root privileges in a guest OS could make a malicious IO request with a large number of blocks that would crash the host OS, leading to a denial of service. This only affected Ubuntu 7.10.

Status

Package Ubuntu Release Status
kvm 8.10 intrepid
Not affected
8.04 LTS hardy
Not affected
7.10 gutsy
Not affected
7.04 feisty
Not affected
6.06 LTS dapper Not in release
linux 8.10 intrepid
Not affected
8.04 LTS hardy
Not affected
7.10 gutsy Not in release
6.06 LTS dapper Not in release
linux-source-2.6.15 8.10 intrepid Not in release
8.04 LTS hardy Not in release
7.10 gutsy Not in release
6.06 LTS dapper
Not affected
linux-source-2.6.22 8.10 intrepid Not in release
8.04 LTS hardy Not in release
7.10 gutsy
Fixed 2.6.22-16.60
6.06 LTS dapper Not in release
qemu 8.10 intrepid
Not affected
8.04 LTS hardy
Not affected
7.10 gutsy
Not affected
7.04 feisty
Not affected
6.06 LTS dapper
Not affected
xen-3.0 8.10 intrepid Not in release
8.04 LTS hardy Not in release
7.10 gutsy Not in release
7.04 feisty
Not affected
6.06 LTS dapper Not in release
xen-3.1 8.10 intrepid
Not affected
8.04 LTS hardy
Not affected
7.10 gutsy
Not affected
7.04 feisty Not in release
6.06 LTS dapper Not in release
xen-3.2 8.10 intrepid Not in release
8.04 LTS hardy
Not affected
7.10 gutsy Not in release
7.04 feisty Not in release
6.06 LTS dapper Not in release
xen-3.3 8.10 intrepid
Not affected
8.04 LTS hardy Not in release
7.10 gutsy Not in release
7.04 feisty Not in release
6.06 LTS dapper Not in release

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package Patch details
linux-source-2.6.22

References

Related Ubuntu Security Notices (USN)

    • USN-679-1
    • Linux kernel vulnerabilities
    • 27 November 2008

Other references