CVE-2011-1166

Vulnerability

A flaw exists in the Xen hypervisor implementation for managing page tables when a 64-bit PV guest requests user-mode execution without providing user-mode page tables. This missing validation in the page table handling code, present in Xen versions possibly before 4.0.2, allows a local privileged guest user to trigger a denial of service [1][2].

Exploitation

An attacker must have local access to a 64-bit PV guest and have sufficient privileges within that guest to set up the CPU state to specify user-mode execution without the required user-mode page tables. No additional user interaction or network access is needed. The sequence involves the guest crafted context that triggers the missing error check in the Xen hypervisor's page table handling code [1][2].

Impact

Successful exploitation leads to a denial of service where the host (Xen Domain 0) and all guest virtual machines lock up or crash, preventing any further operations until the physical host is restarted [1][2].

Mitigation

Red Hat Enterprise Linux 5 addressed this issue with kernel updates released in July 2011 (RHSA-2011:0833). Avaya also released fixed kernel packages in advisory ASA-2011-208. Users should apply the updated kernel packages from their respective vendors. No KEV listing is available for this CVE. No workaround exists other than applying the patch [1][2].