Date: Tue, 01 Sep 2015 13:19:07 +0000 From: Xen.org security team <security@....org> To: xen-announce@...ts.xen.org, xen-devel@...ts.xen.org, xen-users@...ts.xen.org, oss-security@...ts.openwall.com CC: Xen.org security team <security@....org> Subject: Xen Security Advisory 141 (CVE-2015-6654) - printk is not rate-limited in xenmem_add_to_physmap_one -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Xen Security Advisory CVE-2015-6654 / XSA-141 version 3 printk is not rate-limited in xenmem_add_to_physmap_one UPDATES IN VERSION 3 ==================== Public release. ISSUE DESCRIPTION ================= XENMAPSPACE_gmfn_foreign dumps the p2m, on ARM, when it fails to get a reference on the foreign page. However, dump_p2m_lookup does not use rate-limited printk. A malicious infrastructure domain, which is allowed to map memory of a foreign guest, would be able to flood the Xen console. IMPACT ====== Domains deliberately given partial management control may be able to deny service to other parts of the system. As a result, in a system designed to enhance security by radically disaggregating the management, the security may be reduced. But, the security will be no worse than a non-disaggregated design. VULNERABLE SYSTEMS ================== This issue is only relevant to systems which intend to increase security through the use of advanced disaggregated management techniques. This does not include systems using libxl, libvirt, xm/xend, XCP/XenServer, OpenStack or CloudStack (unless substantially modified or supplemented, as compared to versions supplied by the respective upstreams). This issue is not relevant to stub device models, driver domains, or stub xenstored. Those disaggregation techniques do not rely on granting the semi-privileged support domains access to the affected hypercall, and are believed to provide the intended security benefits. Only ARM systems are potentially affected. All Xen versions which support ARM are potentially affected. MITIGATION ========== Reducing the hypervisor log level can be used to suppress messages. Switching from disaggregated to a non-disaggregated operation does NOT mitigate these vulnerabilities. Rather, it simply recategorises the vulnerability to hostile management code, regarding it "as designed"; thus it merely reclassifies these issues as "not a bug". Users and vendors of disaggregated systems should not change their configuration. CREDITS ======= This issue was discovered by Julien Grall of Citrix. RESOLUTION ========== Applying the appropriate attached patch resolves this issue. xsa141.patch Xen 4.4.x, 4.5.x, xen-unstable $ sha256sum xsa141*.patch 12358565dc443e1855a1b5776fa9008c5ea5e5854bd4e93b88ab4178c698fc2a xsa141.patch $ DEPLOYMENT DURING EMBARGO ========================= Deployment of the patches and/or mitigations described above (or others which are substantially similar) is permitted during the embargo, even on public-facing systems with untrusted guest users and administrators. But: Distribution of updated software is prohibited (except to other members of the predisclosure list). Predisclosure list members who wish to deploy significantly different patches and/or mitigations, please contact the Xen Project Security Team. (Note: this during-embargo deployment notice is retained in post-embargo publicly released Xen Project advisories, even though it is then no longer applicable. This is to enable the community to have oversight of the Xen Project Security Team's decisionmaking.) For more information about permissible uses of embargoed information, consult the Xen Project community's agreed Security Policy: http://www.xenproject.org/security-policy.html -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) iQEcBAEBAgAGBQJV5aV+AAoJEIP+FMlX6CvZz74H/jn2L3URqeatI7eBXRtpC9SL DshKXMZRC746x5W06nsFp9dxr/ggSrMG1avM3q/V2dF5Sb/RDyH3A4D8DVhZOFQh jxYScztKJI2OjRmPJvPatVR9oYBQhLpwg8yE3ye6//ObHCO3PSqX28VqWkS8gZha E3Cr3PpbWN1nO1PkHZBqq9BRT7B6Nq/1HE3TnbgjYVWUryWMUUp6GZOZ9QYOTbQB F5I7oimZ/mW2B4PL9p2lCKnCBDJIELpeE6sZAmv8yeQg7Lq7UhwWnB57U8gOOe1I uzV5z852a9Hqdn8flUOGn0eQxputFRdOTamaMqQ2UtG2f0E+l2R6ahD1CGyTmBM= =pKQu -----END PGP SIGNATURE----- [ CONTENT OF TYPE application/octet-stream SKIPPED ]
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ