Re: Xen Security Advisory 99 - unexpected pitfall in xenaccess API

[Steven Haigh <netwiz@crc.id.au>]

[-- Attachment #1.1: Type: text/plain, Size: 2025 bytes --]

On 17/06/14 23:13, Andres Lagar Cavilla wrote:
>                     Xen Security Advisory XSA-99
>                              version 2
> 
>                  unexpected pitfall in xenaccess API
> 
> UPDATES IN VERSION 2
> ====================
> 
> Public Release.
> 
> Added note regarding CVE.
> 
> ISSUE DESCRIPTION
> =================
> 
> A test/example program, for exercising the Xen memaccess API, does not
> take all necessary precautions against hostile guest behaviour.
> 
> As a result, software developers using it as an example or template
> might have written and deployed vulnerable code.
> 
>> How?
> 
>> I've looked at the patch. It's the refactor proposed in a separate
>> thread by Dushyant Behl, lifted up a level. Obviously useful, +2.
> 
>> But fundamentally, how is this a vulnerability? Since the dawn of time
>> guests can poke at the qemu and PV frontend rings. So self DoS, check.
>> But, privilege escalation?
> 
>> Is this predicated on the potential (lack of) software quality of the
>> xenaccess backends? That's a fair argument, but a different story.
> 
>> I am puzzled how this is an XSA that addresses "privilege escalation".

Also note:
[netwiz@dev xen-4.2.4]$ patch -p1 < ../xsa-99.patch
patching file tools/libxc/xc_mem_access.c
Hunk #1 succeeded at 24 with fuzz 2.
patching file tools/libxc/xc_mem_event.c
patching file tools/libxc/xenctrl.h
Hunk #1 succeeded at 1907 (offset -116 lines).
Hunk #2 succeeded at 1933 with fuzz 2 (offset -116 lines).
patching file tools/tests/xen-access/xen-access.c
Hunk #1 succeeded at 233 (offset 10 lines).
Hunk #2 succeeded at 254 (offset 10 lines).
Hunk #3 succeeded at 269 (offset 10 lines).
Hunk #4 FAILED at 293.
1 out of 4 hunks FAILED -- saving rejects to file
tools/tests/xen-access/xen-access.c.rej

In a nutshell, it doesn't apply cleanly either...

-- 
Steven Haigh

Email: netwiz@crc.id.au
Web: http://www.crc.id.au
Phone: (03) 9001 6090 - 0412 935 897
Fax: (03) 8338 0299


[-- Attachment #1.2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 836 bytes --]

[-- Attachment #2: Type: text/plain, Size: 126 bytes --]

_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
http://lists.xen.org/xen-devel