Date: Tue, 08 Jan 2019 16:44:05 +0000 From: Xen.org security team <security@....org> To: xen-announce@...ts.xen.org, xen-devel@...ts.xen.org, xen-users@...ts.xen.org, oss-security@...ts.openwall.com CC: Xen.org security team <security-team-members@....org> Subject: Xen Security Advisory 276 v3 (CVE-2018-19963) - resource accounting issues in x86 IOREQ server handling -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Xen Security Advisory CVE-2018-19963 / XSA-276 version 3 resource accounting issues in x86 IOREQ server handling UPDATES IN VERSION 3 ==================== CVE assigned. ISSUE DESCRIPTION ================= Allocation of pages used to communicate with external emulators did not follow certain principles that are required for proper life cycle management of guest exposed pages. IMPACT ====== A compromised DM stubdomain may cause Xen to crash, resulting in a DoS (Denial of Service) affecting the entire host. Privilege escalation as well as information leaks cannot be ruled out. VULNERABLE SYSTEMS ================== Only Xen 4.11 is affected by this vulnerability. Xen 4.10 and older are not affected by this vulnerability. Only systems running HVM guests with their devicemodels in a stubdomain are considered vulnerable. Note that attackers also need to exploit the devicemodel in order to have access to this vulnerability. Arm guests cannot leverage this vulnerability. MITIGATION ========== Running only PV guests will avoid this vulnerability. (The security of a Xen system using stub domains is still better than with a qemu-dm running as an unrestricted dom0 process. Therefore users with these configurations should not switch to an unrestricted dom0 qemu-dm.) CREDITS ======= This issue was discovered by Julien Grall of ARM. RESOLUTION ========== Applying the appropriate set of attached patches resolves this issue. xsa276/*.patch xen-unstable xsa276-4.11/*.patch Xen 4.11.x $ sha256sum xsa276* xsa276*/* efe9f031c5646b111cbfbe35141a7d99eb31ead07c1c6051145abbd9a3def5b9 xsa276.meta 7f77225e3de780a2507714caab5870664634bf9f76215547bebd31a6399a86ef xsa276-4.11/0001-x86-hvm-ioreq-fix-page-referencing.patch c93c66090009833cd11fabe72b523cbdb3467fa104cc97d1855d365881aa7f8e xsa276-4.11/0002-x86-hvm-ioreq-use-ref-counted-target-assigned-shared.patch ef8b89375866821f4a612f600d10834bf65d811b1784a4ee0fde4a3a409501e0 xsa276/0001-x86-hvm-ioreq-fix-page-referencing.patch 75398ec343b9aaebf0c7dc0c5ef5ed7a3f3be0959f1519db5c7f32c44e7a54d3 xsa276/0002-x86-hvm-ioreq-use-ref-counted-target-assigned-shared.patch $ DEPLOYMENT DURING EMBARGO ========================= Deployment of the patches and/or mitigations described above (or others which are substantially similar) is permitted during the embargo, even on public-facing systems with untrusted guest users and administrators. But: Distribution of updated software is prohibited (except to other members of the predisclosure list). Predisclosure list members who wish to deploy significantly different patches and/or mitigations, please contact the Xen Project Security Team. (Note: this during-embargo deployment notice is retained in post-embargo publicly released Xen Project advisories, even though it is then no longer applicable. This is to enable the community to have oversight of the Xen Project Security Team's decisionmaking.) For more information about permissible uses of embargoed information, consult the Xen Project community's agreed Security Policy: http://www.xenproject.org/security-policy.html -----BEGIN PGP SIGNATURE----- iQFABAEBCAAqFiEEI+MiLBRfRHX6gGCng/4UyVfoK9kFAlw00y0MHHBncEB4ZW4u b3JnAAoJEIP+FMlX6CvZcpAH/3AuQ0b6D3duO1/p1wHhNGwGOLf4uCIH85h+J1Vx TRh77PtztIxosC4OtLObcOtLqf2qUH8SBXnKGiWeyDSjkS1ff8BCRbI8o6xdbvZz wvuMZMoRjIjGqHmVQtI4Jmm260RdmQKeiWZydq0XTKp80oI8hqsid84eY0xDXYKi GFjream7Vr93RuvhJelTRJGnZrVa630FlI8E8aI2BYrFKW2BaCXxBs6ZQY0UBhXM rjqfSj4Ws640B8Sk2Shi8UNGI2rm+kF83s3VlXodGNDjOapXD8bYRp7UcxjnZ+R2 dLSFKdiwZ8598x82WhGn4J464l0tnmGQ6WaH08ZwM1xZD5U= =Df4x -----END PGP SIGNATURE----- Download attachment "xsa276.meta" of type "application/octet-stream" (587 bytes) Download attachment "xsa276-4.11/0001-x86-hvm-ioreq-fix-page-referencing.patch" of type "application/octet-stream" (3868 bytes) Download attachment "xsa276-4.11/0002-x86-hvm-ioreq-use-ref-counted-target-assigned-shared.patch" of type "application/octet-stream" (3333 bytes) Download attachment "xsa276/0001-x86-hvm-ioreq-fix-page-referencing.patch" of type "application/octet-stream" (3868 bytes) Download attachment "xsa276/0002-x86-hvm-ioreq-use-ref-counted-target-assigned-shared.patch" of type "application/octet-stream" (3339 bytes)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.