CVE-2011-1780

Vulnerability

The instruction emulation in Xen 3.0.3 on AMD SVM (Secure Virtual Machine) systems contains a race condition. When a guest user-space process in an SMP (Symmetric Multi-Processing) guest triggers a VM exit by executing a legitimate instruction, a second thread can replace that instruction before the emulator reads it. This causes the emulator to decode and execute a different instruction, leading to undefined behavior. The vulnerability affects Xen 3.0.3 as shipped with Red Hat Enterprise Linux 5 (xen packages) [3][4].

Exploitation

An attacker must have local user access to an SMP guest and the ability to run two concurrent threads. The attacker first runs a thread that executes an instruction known to cause a VM exit (e.g., I/O instructions). Simultaneously, a second thread modifies the memory location of that instruction to a different instruction. Due to the race window, the emulator may read the modified instruction instead of the original, causing incorrect emulation [3][4].

Impact

Successful exploitation results in a denial of service: the host system crashes. The attacker, an unprivileged guest user, can cause the host to reboot or become unresponsive. No data compromise or privilege escalation is reported [3][4].

Mitigation

Red Hat Enterprise Linux 5 users should apply the updates provided in RHSA-2011-1065 and RHSA-2011-1163 [1][2]. The upstream Xen project was not affected according to the advisory [3]. No workaround is documented; patching is the only mitigation.