Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 14 Jun 2012 20:20:07 +0200
From: Florian Weimer <fw@...eb.enyo.de>
To: oss-security@...ts.openwall.com
Subject: Re: Xen Security Advisory 9 (CVE-2012-2934) - PV guest host DoS (AMD erratum #121)

* Xen org security team:

> There is no software fix for this issue. The workaround suggested by
> AMD in erratum #121 cannot be applied to Xen since the relevant address
> is under guest control.
>
> Applying the patch will cause Xen to detect vulnerable systems and
> refuse to boot.

This response puzzles me.  Isn't this changing a potential denial of
service (a para-virtualized guest could attempt an exploit) to a
definite one (the system won't boot)?  Why is this a good idea?

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.