An issue was discovered in drivers/xen/balloon.c in the Linux kernel before 5.2.3, as used in Xen through 4.12.x, allowing guest OS users to cause a denial of service because of unrestricted resource consumption during the mapping of guest memory, aka CID-6ef36ab967c7.
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
| Link | Tags |
|---|---|
| http://xenbits.xen.org/xsa/advisory-300.html | |
| https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.2.3 | third party advisory |
| https://xenbits.xen.org/xsa/advisory-300.html | vendor advisory |
| https://github.com/torvalds/linux/commit/6ef36ab967c71690ebe7e5ef997a8be4da3bc844 | third party advisory patch |
| http://www.openwall.com/lists/oss-security/2019/10/25/9 | mailing list |
| https://security.netapp.com/advisory/ntap-20191031-0005/ | |
| https://usn.ubuntu.com/4286-2/ | vendor advisory |
| https://usn.ubuntu.com/4286-1/ | vendor advisory |