Date: Thu, 29 Oct 2015 12:00:14 +0000 From: Xen.org security team <security@....org> To: xen-announce@...ts.xen.org, xen-devel@...ts.xen.org, xen-users@...ts.xen.org, oss-security@...ts.openwall.com CC: Xen.org security team <security@....org> Subject: Xen Security Advisory 145 (CVE-2015-7812) - arm: Host crash when preempting a multicall -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Xen Security Advisory CVE-2015-7812 / XSA-145 version 3 arm: Host crash when preempting a multicall UPDATES IN VERSION 3 ==================== Public release. ISSUE DESCRIPTION ================= Early versions of Xen on ARM did not support "multicall" functionality (the ability to perform multiple operations via a single hypercall) and therefore stubbed out the functionality needed to support preemption of multicalls in a manner which crashed the host. When multicall support was subsequently added these stubs were not replaced with the correct functionality and therefore exposed to guests a code path which crashes the host. Any guest can issue a preemptable hypercall via the multicall interface to exploit this vulnerability. IMPACT ====== A malicious guest can crash the host. VULNERABLE SYSTEMS ================== Both 32- and 64-bit ARM systems are vulnerable from Xen 4.4 onward. x86 systems are not vulnerable. MITIGATION ========== On systems where the guest kernel is controlled by the host rather than guest administrator, running only kernels which do not make use of multicall functionality will prevent untrusted guest users from exploiting this issue. However untrusted guest administrators can still trigger it unless further steps are taken to prevent them from loading code into the kernel (e.g. by disabling loadable modules etc) or from using other mechanisms which allow them to run code at kernel privilege. CREDITS ======= This issue was discovered by Julien Grall of Citrix. RESOLUTION ========== Applying the attached patch resolves this issue. xsa145.patch xen-unstable, Xen 4.6.x, Xen 4.5.x, Xen 4.4.x $ sha256sum xsa145*.patch 4d4a4724e4d367ddfc9ac1b43dfe81bce873c65fe9bb13f443266dd12c002db1 xsa145.patch $ DEPLOYMENT DURING EMBARGO ========================= Deployment of the patches and/or mitigations described above (or others which are substantially similar) is permitted during the embargo, even on public-facing systems with untrusted guest users and administrators. But: Distribution of updated software is prohibited (except to other members of the predisclosure list). Predisclosure list members who wish to deploy significantly different patches and/or mitigations, please contact the Xen Project Security Team. (Note: this during-embargo deployment notice is retained in post-embargo publicly released Xen Project advisories, even though it is then no longer applicable. This is to enable the community to have oversight of the Xen Project Security Team's decisionmaking.) For more information about permissible uses of embargoed information, consult the Xen Project community's agreed Security Policy: http://www.xenproject.org/security-policy.html -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) iQEcBAEBAgAGBQJWMgmzAAoJEIP+FMlX6CvZUV0H/2uDN/R1KaR1x2OljM5toEUR vGrEN1LX/AzQ1f4DADZO4LIvth2BLdFEB6OsaaKThFdnZjJWQ0fbfxIzb6eGOpMR XzuToUEIBTA01JHKNUo5ovWQ36gePyvxkFWDjk8Ixj22YpbuyUDU5HiHH5UpTovg 0QLfJdKDij7Sp3/r9quQ5KSO86kw9CZqut5qRvMI8VKRa03O2jDch5iKkyDTcuCL md7r5+k6O3F4/TVPrlET+BAHOqgOtuQd6EMFfqXolsr12OpzzBz2/ntK4srmqlZc wa7PgAoELAaLnv4nBtFEtIyjg9YI4RIKnMwBbeD9suM305ohi3yDCxDj9eaYJwo= =eNQ5 -----END PGP SIGNATURE----- Download attachment "xsa145.patch" of type "application/octet-stream" (1643 bytes)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.