CVE-2021-47573: xen/blkfront: harden blkfront against event channel storms

CVE-2021-47573: xen/blkfront: harden blkfront against event channel storms

[Greg Kroah-Hartman]

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

xen/blkfront: harden blkfront against event channel storms

The Xen blkfront driver is still vulnerable for an attack via excessive
number of events sent by the backend. Fix that by using lateeoi event
channels.

This is part of XSA-391

The Linux kernel CVE team has assigned CVE-2021-47573 to this issue.


Affected and fixed versions
===========================

	Fixed in 4.4.296 with commit 3e04b9e6aa7d
	Fixed in 4.9.294 with commit 25898389795b
	Fixed in 4.14.259 with commit 5ac3b68b79c9
	Fixed in 4.19.222 with commit 269d7124bcfa
	Fixed in 5.4.168 with commit 4ed9f5c511ce
	Fixed in 5.10.88 with commit 8ac3b6ee7c9f
	Fixed in 5.15.11 with commit caf9b51829a5
	Fixed in 5.16 with commit 0fd08a34e8e3

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2021-47573
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/block/xen-blkfront.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/3e04b9e6aa7d77287e70a400be83060d2b7b2cfe
	https://git.kernel.org/stable/c/25898389795bd85d8e1520c0c75c3ad906c17da7
	https://git.kernel.org/stable/c/5ac3b68b79c9e964dd6f3cf80ff825518e502b79
	https://git.kernel.org/stable/c/269d7124bcfad2558d2329d0fe603ca20b20d3f4
	https://git.kernel.org/stable/c/4ed9f5c511ce95cb8db05ff82026ea901f45fd76
	https://git.kernel.org/stable/c/8ac3b6ee7c9ff2df7c99624bb1235e2e55623825
	https://git.kernel.org/stable/c/caf9b51829a50590b84daea924a0fd62d32bc952
	https://git.kernel.org/stable/c/0fd08a34e8e3b67ec9bd8287ac0facf8374b844a

Re: CVE-2021-47573: xen/blkfront: harden blkfront against event channel storms

[Juergen Gross]

[-- Attachment #1.1.1: Type: text/plain, Size: 596 bytes --]

On 19.06.24 16:54, Greg Kroah-Hartman wrote:
> Description
> ===========
> 
> In the Linux kernel, the following vulnerability has been resolved:
> 
> xen/blkfront: harden blkfront against event channel storms
> 
> The Xen blkfront driver is still vulnerable for an attack via excessive
> number of events sent by the backend. Fix that by using lateeoi event
> channels.
> 
> This is part of XSA-391
> 
> The Linux kernel CVE team has assigned CVE-2021-47573 to this issue.

When issuing XSA-391 the Xen security team already assigned CVE-2021-28711
to this issue.


Juergen

[-- Attachment #1.1.2: OpenPGP public key --]
[-- Type: application/pgp-keys, Size: 3743 bytes --]

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 495 bytes --]

Re: CVE-2021-47573: xen/blkfront: harden blkfront against event channel storms

[Greg Kroah-Hartman]

On Thu, Jun 20, 2024 at 09:53:02AM +0200, Juergen Gross wrote:
> On 19.06.24 16:54, Greg Kroah-Hartman wrote:
> > Description
> > ===========
> > 
> > In the Linux kernel, the following vulnerability has been resolved:
> > 
> > xen/blkfront: harden blkfront against event channel storms
> > 
> > The Xen blkfront driver is still vulnerable for an attack via excessive
> > number of events sent by the backend. Fix that by using lateeoi event
> > channels.
> > 
> > This is part of XSA-391
> > 
> > The Linux kernel CVE team has assigned CVE-2021-47573 to this issue.
> 
> When issuing XSA-391 the Xen security team already assigned CVE-2021-28711
> to this issue.

Cool, but why was that not documented in the CVE entry itself?  I search
the existing CVE database when assigning CVEs for older things like this
(the import of the GSD database), and if there is no reference in the
CVE entry, then I have to assume that no CVE was assigned to the commit.

I'll go reject this one (and the other ones you pointed out), but can
you please update the CVE json entry with the information and ids of the
fixed commits so that everyone can correctly track these?

Also, the XSA-391 announcement doesn't say anything about them either,
is that intentional?

thanks,

greg k-h

Re: CVE-2021-47573: xen/blkfront: harden blkfront against event channel storms

[Jan Beulich]

On 20.06.2024 10:18, Greg Kroah-Hartman wrote:
> Also, the XSA-391 announcement doesn't say anything about them either,
> is that intentional?

If by announcement you mean the email sent out to xen-security-issues@lists.xen.org,
then the copy I'm looking at (v3, the only one having gone public afaict) clearly
lists the three CVEs.

Jan

Re: CVE-2021-47573: xen/blkfront: harden blkfront against event channel storms

[Greg Kroah-Hartman]

On Thu, Jun 20, 2024 at 10:46:10AM +0200, Jan Beulich wrote:
> On 20.06.2024 10:18, Greg Kroah-Hartman wrote:
> > Also, the XSA-391 announcement doesn't say anything about them either,
> > is that intentional?
> 
> If by announcement you mean the email sent out to xen-security-issues@lists.xen.org,
> then the copy I'm looking at (v3, the only one having gone public afaict) clearly
> lists the three CVEs.

I'm looking at:
	https://xenbits.xen.org/xsa/advisory-391.html
and I don't see a git id anywhere, where do you see the v3 announcement
saying that?

Also, the json file at:
	https://www.cve.org/CVERecord?id=CVE-2021-28711
points to:
	https://xenbits.xenproject.org/xsa/advisory-391.txt
Not to the html document, which is correct?

But to be fair, I'm not going to be able to search all links in all json
files for all entries, so even if the 391 announcement did show the git
ids for the changes, I would miss it.  All I can do is search the json
repo for all CVEs.

thanks,

greg k-h

Re: CVE-2021-47573: xen/blkfront: harden blkfront against event channel storms

[Jan Beulich]

On 20.06.2024 11:20, Greg Kroah-Hartman wrote:
> On Thu, Jun 20, 2024 at 10:46:10AM +0200, Jan Beulich wrote:
>> On 20.06.2024 10:18, Greg Kroah-Hartman wrote:
>>> Also, the XSA-391 announcement doesn't say anything about them either,
>>> is that intentional?
>>
>> If by announcement you mean the email sent out to xen-security-issues@lists.xen.org,
>> then the copy I'm looking at (v3, the only one having gone public afaict) clearly
>> lists the three CVEs.
> 
> I'm looking at:
> 	https://xenbits.xen.org/xsa/advisory-391.html
> and I don't see a git id anywhere, where do you see the v3 announcement
> saying that?

Hmm, okay, I then misunderstood your earlier reply: I was assuming you
were looking for the CVE numbers associated with the XSA, as I thought
that's what you need to know when deciding whether to issue one
yourself. No, we didn't ever mention commit IDs anywhere, except when
issuing XSAs after-the-fact (i.e. changes already having gone in earlier
on). I guess we need to see whether that's feasible to do for Linux XSAs
going forward. Yet then it may not be needed there, as we'd now ask you
for CVE numbers in such cases anyway?

Jan

> Also, the json file at:
> 	https://www.cve.org/CVERecord?id=CVE-2021-28711
> points to:
> 	https://xenbits.xenproject.org/xsa/advisory-391.txt
> Not to the html document, which is correct?
> 
> But to be fair, I'm not going to be able to search all links in all json
> files for all entries, so even if the 391 announcement did show the git
> ids for the changes, I would miss it.  All I can do is search the json
> repo for all CVEs.
> 
> thanks,
> 
> greg k-h

Re: CVE-2021-47573: xen/blkfront: harden blkfront against event channel storms

[Greg Kroah-Hartman]

On Thu, Jun 20, 2024 at 11:32:49AM +0200, Jan Beulich wrote:
> On 20.06.2024 11:20, Greg Kroah-Hartman wrote:
> > On Thu, Jun 20, 2024 at 10:46:10AM +0200, Jan Beulich wrote:
> >> On 20.06.2024 10:18, Greg Kroah-Hartman wrote:
> >>> Also, the XSA-391 announcement doesn't say anything about them either,
> >>> is that intentional?
> >>
> >> If by announcement you mean the email sent out to xen-security-issues@lists.xen.org,
> >> then the copy I'm looking at (v3, the only one having gone public afaict) clearly
> >> lists the three CVEs.
> > 
> > I'm looking at:
> > 	https://xenbits.xen.org/xsa/advisory-391.html
> > and I don't see a git id anywhere, where do you see the v3 announcement
> > saying that?
> 
> Hmm, okay, I then misunderstood your earlier reply: I was assuming you
> were looking for the CVE numbers associated with the XSA, as I thought
> that's what you need to know when deciding whether to issue one
> yourself. No, we didn't ever mention commit IDs anywhere, except when
> issuing XSAs after-the-fact (i.e. changes already having gone in earlier
> on). I guess we need to see whether that's feasible to do for Linux XSAs
> going forward. Yet then it may not be needed there, as we'd now ask you
> for CVE numbers in such cases anyway?

Yes, going forward it's not going to matter, I was just trying to verify
that when I assign ids for older stuff like this that I'm not messing up
in an obvious way :)

thanks,

greg k-h