Date: Sat, 4 Oct 2008 17:05:57 +0100 From: "Daniel P. Berrange" <berrange@...hat.com> To: "Steven M. Christey" <coley@...us.mitre.org> Cc: oss-security@...ts.openwall.com, coley@...re.org Subject: Re: CVE Request (xen) On Fri, Oct 03, 2008 at 05:17:44PM -0400, Steven M. Christey wrote: > > We wrote this up as a libvirt issue, but is it really a Xen issue? At its core it is a Xen permissions issue, because the host was not protecting data it mainers from guest modification. This permissions problem impacted Xen tools themselves, and any other application which made use of xenstore - of which libvirt was one. The original proposed fix to Xen would require changes in both Xen and libvirt to fully resolve. The Xen developers eventually worked out a fix that directly addresses all users, so there is no longer any need for libvirt to be fixed. It is sufficient to apply the Xen permisions fixes, so I'd class this as primarily a Xen issue. Regards, Daniel -- |: Red Hat, Engineering, London -o- http://people.redhat.com/berrange/ :| |: http://libvirt.org -o- http://virt-manager.org -o- http://ovirt.org :| |: http://autobuild.org -o- http://search.cpan.org/~danberr/ :| |: GnuPG: 7D3B9505 -o- F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 :|
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.