Joanna Rutkowska

A buffer overflow issue exists in Intel Trusted Execution Technology (TXT) SINIT Authenticated Code Modules (ACM) that allows local users to bypass the Trusted Execution Technology protection mechanism. This issue can be exploited via unspecified vectors, allowing users to perform other unspecified SINIT ACM functions.

The issue allows guest OS users to gain host OS privileges by using DMA to generate MSI interrupts by writing to the interrupt injection registers, specifically when using PCI passthrough on Intel VT-d chipsets that do not have interrupt remapping.

The issue allows local users to bypass the Trusted Execution Technology protection mechanism and gain privileges by modifying the MCHBAR register to point to an attacker-controlled region. This prevents the SENTER instruction from properly applying VT-d protection while an MLE is being loaded.

The issue allows local administrators with ring 0 privileges to gain additional privileges and modify code that is running in System Management Mode, or access hypervisory memory. This can be achieved by accessing certain remapping registers, as demonstrated at Black Hat 2008 using Xen 3.3.

The issue allows attackers to bypass intended loader integrity protections. This is demonstrated by exploitation of tboot. As of the given date, the only disclosure is a vague pre-advisory with no actionable information.

A heap-based buffer overflow issue exists in the flask security label function in Xen, when compiled with the XSM:FLASK module. This allows unprivileged domain users (domU) to execute arbitrary code via the flask op hypercall.