OSEC-2016-02

See a problem?
Import Source
https://github.com/ocaml/security-advisories/blob/generated-osv/2016/OSEC-2016-02.json
JSON Data
https://api.osv.dev/v1/vulns/OSEC-2016-02
Published
2016-05-03T00:00:00Z
Modified
2026-01-13T12:00:00Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N CVSS Calculator
Summary
Memory disclosure in mirage-net-xen
Details

Background

MirageOS is a library operating system using cooperative multitasking, which can be executed as a guest of the Xen hypervisor. Virtual devices, such as a network device, share memory between MirageOS and the hypervisor. MirageOS allocates and grants the hypervisor access to a ringbuffer containing pages to be sent on the network device, and another ringbuffer with pages to be filled with received data. A write on the MirageOS side consists of filling the page with the packet data, submitting a write request to the hypervisor, and awaiting a response from the hypervisor. To correlate the request with the response, a 16bit identifier is used.

Problem Description

Generating this 16bit identifier was not done in a unique manner. When multiple pages share an identifier, and are requested to be transmitted via the wire, the first successful response will mark all pages with this identifier free, even those still waiting to be transmitted. Once marked free, the MirageOS application fills the page for another chunk of data. This leads to corrupted packets being sent, and can lead to disclosure of memory intended for another recipient.

Impact

This issue discloses memory intended for another recipient. All versions before mirage-net-xen 1.4.2 are affected. The receiving side uses a similar mechanism, which may lead to corrupted incoming data (eventually even mutated while being processed).

Version 1.5.0, released on 8th January, already assigns unique identifiers for transmission. Received pages are copied into freshly allocated buffers before passed to the next layer. When 1.5.0 was released, the impact was not clear to us. Version 1.6.1 now additionally ensures that received pages have a unique identifier.

Solution

The unique identifier is now generated in a unique manner using a monotonic counter.

Transmitting corrupt data and disclosing memory is fixed in versions 1.4.2 and above.

Database specific 
{
    "cwe": [
        "CWE-416"
    ],
    "osv": "https://github.com/ocaml/security-advisories/tree/generated-osv/2016/OSEC-2016-02.json",
    "human_link": "https://github.com/ocaml/security-advisories/tree/main/advisories/2016/OSEC-2016-02.md"
}
References
Credits
    • Enguerrand Decorne - REPORTER
    • Hannes Mehnert - REPORTER
    • Thomas Leonard - REMEDIATION_DEVELOPER
    • Hannes Mehnert - REMEDIATION_DEVELOPER
    • Mindy Preston - REMEDIATION_REVIEWER

Affected packages

opam / mirage-net-xen

Package

Name
mirage-net-xen
Purl
pkg:opam/mirage-net-xen

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.4.2
Type
GIT
Repo
https://github.com/mirage/mirage-net-xen
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
0b1e53c0875062a50e2d5823b7da0d8e0a64dc37

Affected versions

0.*
0.9.0
1.*
1.1.0
1.1.1
1.1.2
1.1.3
1.2.0
1.3.0
1.4.0
1.4.1

Ecosystem specific 

{
    "opam_constraint": "mirage-net-xen {< \"1.4.2\"}"
}

Database specific

source 
"https://github.com/ocaml/security-advisories/blob/generated-osv/2016/OSEC-2016-02.json"