CVE-2013-2072

Buffer overflow in Python Xen bindings (Xen 4.0.x, 4.1.x, 4.2.x) via xc_vcpu_setaffinity call

• CVSS 7.4
• CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
• Memory Corruption
• Local

Buffer overflow in the Python bindings for the xc_vcpu_setaffinity call in Xen 4.0.x, 4.1.x, and 4.2.x allows local administrators with permissions to configure VCPU affinity to cause a denial of service (memory corruption and xend toolstack crash) and possibly gain privileges via a crafted cpumap.

CVE

CVE-2013-2072

CWE

CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

CVSS base score

7.4

Published

2013-08-28

OWASP

A03 Injection

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Memory Corruption

Subcategory

Buffer Overflows

Accessibility scope

Local

Impact

Denial of Service (DoS)

Fixed by upgrading

Yes

Solution

Update Xen to a fixed version.

def set_vcpu_affinity(vcpu_id, cpumap):
    result = libc.xc_vcpu_setaffinity(vcpu_id, cpumap)
    if result != 0:
        raise RuntimeError("Failed to set VCPU affinity")

vcpu_id = 0
cpumap = '1100000011000000'

set_vcpu_affinity(vcpu_id, cpumap)

import re
import ctypes

def is_valid_cpumap(cpumap):
    return bool(re.match(r'^[01]{16}$', cpumap))

def set_vcpu_affinity(vcpu_id, cpumap):
    if not is_valid_cpumap(cpumap):
        raise ValueError("Invalid cpumap. It must be a 16-character string containing only '0' and '1'.")
    
    cpumap_int = int(cpumap, 2)
    
    result = libc.xc_vcpu_setaffinity(vcpu_id, cpumap_int)
    if result != 0:
        raise RuntimeError("Failed to set VCPU affinity")

vcpu_id = 0
cpumap = '1100000011000000'

set_vcpu_affinity(vcpu_id, cpumap)

@misc{vaitp:cve20132072,
  title        = {{Buffer overflow in Python Xen bindings (Xen 4.0.x, 4.1.x, 4.2.x) via xc_vcpu_setaffinity call}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2013},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2013-2072},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2013-2072/}}
}