[Secure-testing-team] Bug#677221: xen: Xen PV privilege escalation (CVE-2012-0217)

[Arno Töll]

Source: xen
Version: 4.1.2-2
Severity: critical
Tags: security
Justification: allows PV domains to escape into the dom0 context

Hi,

I realize you're most likely pretty well aware of that problem already, but
Debian's Xen versions are vulnerable to a PV privilege escalation [1]. The issue
is tracked as CVE-2012-0217 and public as of today.

Therefore I am filing this bug for coordination and traceability. Please update
the packages and consider a security update for Squeeze.

[1] http://lists.xen.org/archives/html/xen-devel/2012-06/msg00670.html

-- System Information:
Debian Release: wheezy/sid
  APT prefers unstable
  APT policy: (500, 'unstable')
Architecture: amd64 (x86_64)

Kernel: Linux 3.3.0-trunk-amd64 (SMP w/4 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash