[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 17 Jun 2014 23:24:52 +1000
From: Steven Haigh <netwiz@....id.au>
To: Andres Lagar Cavilla <andres@...arcavilla.org>,
xen-devel@...ts.xen.org, security@....org, xen-announce@...ts.xen.org,
oss-security@...ts.openwall.com
Subject: Re: Xen Security Advisory 99 - unexpected pitfall in xenaccess API
On 17/06/14 23:13, Andres Lagar Cavilla wrote:
> Xen Security Advisory XSA-99
> version 2
>
> unexpected pitfall in xenaccess API
>
> UPDATES IN VERSION 2
> ====================
>
> Public Release.
>
> Added note regarding CVE.
>
> ISSUE DESCRIPTION
> =================
>
> A test/example program, for exercising the Xen memaccess API, does not
> take all necessary precautions against hostile guest behaviour.
>
> As a result, software developers using it as an example or template
> might have written and deployed vulnerable code.
>
>> How?
>
>> I've looked at the patch. It's the refactor proposed in a separate
>> thread by Dushyant Behl, lifted up a level. Obviously useful, +2.
>
>> But fundamentally, how is this a vulnerability? Since the dawn of time
>> guests can poke at the qemu and PV frontend rings. So self DoS, check.
>> But, privilege escalation?
>
>> Is this predicated on the potential (lack of) software quality of the
>> xenaccess backends? That's a fair argument, but a different story.
>
>> I am puzzled how this is an XSA that addresses "privilege escalation".
Also note:
[netwiz@dev xen-4.2.4]$ patch -p1 < ../xsa-99.patch
patching file tools/libxc/xc_mem_access.c
Hunk #1 succeeded at 24 with fuzz 2.
patching file tools/libxc/xc_mem_event.c
patching file tools/libxc/xenctrl.h
Hunk #1 succeeded at 1907 (offset -116 lines).
Hunk #2 succeeded at 1933 with fuzz 2 (offset -116 lines).
patching file tools/tests/xen-access/xen-access.c
Hunk #1 succeeded at 233 (offset 10 lines).
Hunk #2 succeeded at 254 (offset 10 lines).
Hunk #3 succeeded at 269 (offset 10 lines).
Hunk #4 FAILED at 293.
1 out of 4 hunks FAILED -- saving rejects to file
tools/tests/xen-access/xen-access.c.rej
In a nutshell, it doesn't apply cleanly either...
--
Steven Haigh
Email: netwiz@....id.au
Web: http://www.crc.id.au
Phone: (03) 9001 6090 - 0412 935 897
Fax: (03) 8338 0299
Download attachment "signature.asc" of type "application/pgp-signature" (837 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
