From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Jan Beulich" Subject: Re: Xen security advisory CVE-2011-1898 - VT-d (PCI passthrough) MSI Date: Fri, 13 May 2011 09:08:09 +0100 Message-ID: <4DCD030902000078000412C8@vpn.id2.novell.com> References: <19915.58644.191837.671729@mariner.uk.xensource.com> Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: quoted-printable Return-path: In-Reply-To: <19915.58644.191837.671729@mariner.uk.xensource.com> Content-Disposition: inline List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: xen-devel-bounces@lists.xensource.com Errors-To: xen-devel-bounces@lists.xensource.com To: Ian Jackson , Keir Fraser Cc: xen-devel@lists.xensource.com List-Id: xen-devel@lists.xenproject.org >>> On 12.05.11 at 15:48, Ian Jackson wrote: > Intel VT-d chipsets without interrupt remapping do not prevent a guest > which owns a PCI device from using DMA to generate MSI interrupts by > writing to the interrupt injection registers. This can be exploited > to inject traps and gain control of the host. Isn't that (or at least can't that be) prevented with DMA remapping? > The first patch is intended to reduce the impact from full privilege > escalation to denial of service. > Filename: 00-block-msis-on-trap-vectors > SHA1: 0fcc1914714c228e98b3e84597e06cb5de09003c > SHA256: 998e8d5632ee6ad92f52796fe94923f9c38096c5adf2ca74209a6792436ea1e9= You modify only 64-bit and only VT-d code here. While I know you don't care much for it, doing the same for 32-bit would seem trivial. As to AMD's IOMMU, it may well be that interrupt re-mapping isn't optional in the hardware (albeit it can be disabled on the command line, though that's the admin's security risk then), but the code having BUG_ON()s on failed allocations and those allocations happening in table parsing callbacks doesn't really make this explicit (for me at least) on the first glance. Finally, wouldn't killing all guests that potentially could have caused the problem be a better measure than bringing down the host? Jan