Your submission was sent successfully! Close

You have successfully unsubscribed! Close

Thank you for signing up for our newsletter!
In these regular emails you will find the latest updates about Ubuntu and upcoming events where you can meet our team.Close

CVE-2010-4247

Publication date 10 January 2011

Last updated 24 July 2024

Ubuntu priority

Medium

Why this priority?

The do_block_io_op function in (1) drivers/xen/blkback/blkback.c and (2) drivers/xen/blktap/blktap.c in Xen before 3.4.0 for the Linux kernel 2.6.18, and possibly other versions, allows guest OS users to cause a denial of service (infinite loop and CPU consumption) via a large production request index to the blkback or blktap back-end drivers. NOTE: some of these details are obtained from third party information.

From the Ubuntu Security Team

It was discovered that Xen did not correctly handle certain block requests. A local attacker in a Xen guest could cause the Xen host to use all available CPU resources, leading to a denial of service.

Read the notes from the security team

Status

Package Ubuntu Release Status
linux 11.04 natty
Not affected
10.10 maverick
Not affected
10.04 LTS lucid
Not affected
9.10 karmic Ignored
8.04 LTS hardy
Fixed 2.6.24-29.91
6.06 LTS dapper Not in release
linux-ec2 11.04 natty Not in release
10.10 maverick Ignored
10.04 LTS lucid
Not affected
9.10 karmic Ignored
8.04 LTS hardy Not in release
6.06 LTS dapper Not in release
linux-fsl-imx51 11.04 natty Not in release
10.10 maverick Not in release
10.04 LTS lucid
Not affected
9.10 karmic Ignored
8.04 LTS hardy Not in release
6.06 LTS dapper Not in release
linux-lts-backport-maverick 11.04 natty Not in release
10.10 maverick Not in release
10.04 LTS lucid
Not affected
9.10 karmic Not in release
8.04 LTS hardy Not in release
6.06 LTS dapper Not in release
linux-lts-backport-natty 11.04 natty Not in release
10.10 maverick Not in release
10.04 LTS lucid
Not affected
8.04 LTS hardy Not in release
linux-mvl-dove 11.04 natty Not in release
10.10 maverick
Not affected
10.04 LTS lucid
Not affected
9.10 karmic Ignored
8.04 LTS hardy Not in release
6.06 LTS dapper Not in release
linux-source-2.6.15 11.04 natty Not in release
10.10 maverick Not in release
10.04 LTS lucid Not in release
9.10 karmic Not in release
8.04 LTS hardy Not in release
6.06 LTS dapper Ignored
linux-ti-omap4 11.04 natty
Not affected
10.10 maverick
Not affected
10.04 LTS lucid Not in release
9.10 karmic Not in release
8.04 LTS hardy Not in release
6.06 LTS dapper Not in release
xen-3.1 11.04 natty Not in release
10.10 maverick Not in release
10.04 LTS lucid Not in release
9.10 karmic Not in release
8.04 LTS hardy
Not affected
6.06 LTS dapper Not in release

Notes

jdstrand

xen-3.1 has linux-2.6-xen-sparse/drivers/xen/blkback/blkback.c, but xen-3.2 and xen-3.3 do not marking dapper task as ignored since we no longer support xen userspace on Dapper anyway

smb

My feeling is that xen-3.1 has code affected, but does not package that up. That would make only Hardy kernel code truely affected. Oneiric not-affected for now (not containing blkback) and when we move to upstream v3.0 is is fixed there.

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package Patch details
linux

References

Related Ubuntu Security Notices (USN)

    • USN-1170-1
    • Linux kernel vulnerabilities
    • 15 July 2011

Other references