Date: Tue, 22 Dec 2015 18:47:18 +0000 From: Xen.org security team <security@....org> To: xen-announce@...ts.xen.org, xen-devel@...ts.xen.org, xen-users@...ts.xen.org, oss-security@...ts.openwall.com CC: Xen.org security team <security@....org> Subject: Xen Security Advisory 169 (CVE-2015-8615) - x86: unintentional logging upon guest changing callback method -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Xen Security Advisory CVE-2015-8615 / XSA-169 version 2 x86: unintentional logging upon guest changing callback method UPDATES IN VERSION 2 ==================== CVE assigned. ISSUE DESCRIPTION ================= HYPERVISOR_hvm_op sub-op HVMOP_set_param's HVM_PARAM_CALLBACK_IRQ operation intends to log the new callback method in debug builds only. The full message, however, is split into two parts, the second one of which didn't get suppressed on non-debug builds as would have been intended. These log messages are not rate-limited and can be triggered by guests. IMPACT ====== A malicious guest could cause repeated logging to the hypervisor console, leading to a Denial of Service attack. VULNERABLE SYSTEMS ================== Xen version 4.6 is affected. Older Xen versions are unaffected. ARM systems are not affected. Only x86 HVM guests can expose this vulnerability. MITIGATION ========== Running only PV guests will avoid this issue. The problematic log messages are issued with priority Warning. Therefore they can be rate limited by adding "loglvl=error/warning" to the hypervisor command line or suppressed entirely by adding "loglvl=error". On systems where the guest kernel is controlled by the host rather than guest administrator, running only kernels which do not excessively invoke this operation will also prevent untrusted guest users from exploiting this issue. However untrusted guest administrators can still trigger it unless further steps are taken to prevent them from loading code into the kernel (e.g. by disabling loadable modules etc) or from using other mechanisms which allow them to run code at kernel privilege. NOTE REGARDING LACK OF EMBARGO ============================== The fix for this bug was publicly posted on xen-devel, before it was appreciated that there was a security problem. CREDITS ======= This issue was discovered as a bug by Malcolm Crossley of Citrix; the security impact was recognised by Jan Beulich of SuSE. RESOLUTION ========== Applying the attached patch resolves this issue. xsa169.patch xen-unstable, Xen 4.6.x $ sha256sum xsa169* b818922880313cdbc12ea68ae757da5eabed9b3c9e1f8acefe1653683545ccbe xsa169.patch $ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) iQEcBAEBAgAGBQJWeZqAAAoJEIP+FMlX6CvZ/HcIAMLIVFDrwUahqNkGIaS0rXrn LJG6+oMewioAm05NEKI+2wkJn6T4ycJsn+rVWMyOTHpS39vA1kMZK3/Pb/smV3B1 2K+g8avmSjB22VEhjEoKIGniozkPIInB5Pvchf0GY6C30/LJM2ef3hJeQHUA+W9q 68HiXZrwFUUBRcpjoSX3ru954Fcfe0VDpEvIRJRS1O4v/XXJeesavt/0/5PnaP34 sRXr9+l7Ku+Q9z7sh9V87W9Lv98qXnuVns7c3GKIcmDEcvWDihwazCbvuVOZsvQW UoV4/LTiJ2bTqnGp2woUqlTfe7MIOHPzjmR88Pj+/ibveObkcVMDxyz4r34wyxw= =D97B -----END PGP SIGNATURE----- Download attachment "xsa169.patch" of type "application/octet-stream" (1082 bytes)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.