From: Kurt Seifried <kseifried-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
To: oss-security-ZwoEplunGu1jrUoiu81ncdBPR1lH4CV8@public.gmane.org
Cc: "Xen.org security team" <security-LM2mM/qkH7s@public.gmane.org>,
xen-announce-GuqFBffKawuULHF6PoxzQEEOCMrvLtNR@public.gmane.org,
xen-devel-GuqFBffKawuULHF6PoxzQEEOCMrvLtNR@public.gmane.org,
xen-users-GuqFBffKawuULHF6PoxzQEEOCMrvLtNR@public.gmane.org
Subject: Re: Xen Security Advisory 10 - HVM guest user mode MMIO emulation DoS
Date: Fri, 27 Jul 2012 02:10:04 -0600 [thread overview]
Message-ID: <50124CDC.70401@redhat.com> (raw)
In-Reply-To: <20497.25251.118584.533875-msK/Ju9w1zmnROeE8kUsYhEHtJm+Wo+I@public.gmane.org>
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 07/26/2012 09:30 AM, Xen.org security team wrote:
>
> Xen Security Advisory XSA-10
>
> HVM guest user mode MMIO emulation DoS vulnerability
>
> ISSUE DESCRIPTION =================
>
> Internal data of the emulator for MMIO operations may, under
> certain rare conditions, at the end of one emulation cycle be left
> in a state affecting a subsequent emulation such that this second
> emulation would fail, causing an exception to be reported to the
> guest kernel where none is expected.
>
> IMPACT ======
>
> Guest mode unprivileged (user) code, which has been granted the
> privilege to access MMIO regions, may leverage that access to crash
> the whole guest.
>
> VULNERABLE SYSTEMS ==================
>
> All HVM guests exposing MMIO ranges to unprivileged (user) mode.
>
> All versions of Xen which support HVM guests are vulnerable to this
> issue.
>
> MITIGATION ==========
>
> This issue can be mitigated by running PV (para-virtualised) guests
> only, or by ensuring (inside the guest) that MMIO regions can be
> accessed only by trustworthy processes.
>
> RESOLUTION ==========
>
> Applying the appropriate attached patch will resolve the issue.
>
> NOTE REGARDING CVE ==================
>
> We do not yet have a CVE Candidate number for this vulnerability.
>
> PATCH INFORMATION =================
>
> The attached patches resolve this issue
>
> $ sha256sum xsa10-*.patch
> f96b7849194901d7f663895f88c2ca4f4721559f1c1fe13bba515336437ab912
> xsa10-4.x.patch
> fb9dead017dfea99ad3e8d928582e67160c76518b7fe207d9a3324811baf06dd
> xsa10-unstable.patch
Please use CVE-2012-3432 for this issue.
- --
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
iQIcBAEBAgAGBQJQEkzcAAoJEBYNRVNeJnmTBi8QANKeCCOiniLKp5+1LvYXr3rE
uV9UijoVTBu6WNtB2L9NXRrenHBvGv38+tmVVg7pCqHkU9nrzhmg4zc8qZY8LJ/V
/ZnYuVoWZ/hG+KNi8/NQIiDAiDu4Ip9NnMSW9SdYPVEFSQN4JCQufYOxjCGNzOj1
QidDoyb7i63UAFXj4nvdFmJKVYSvegI+H46vGVkQabBdZ2LXuCHYCw54ZZ0nFqKj
LU3t/468DmBn1Gk2EUdufV/NWxWpD33pjwTkMFbYH/C5cSHUMx6UUkD48EWu0YAs
MxjigqXHKiXEPsoyfULppRTaxE969MsWDhrjrptymZjasmcXl+v/opmVYT9DJ1gF
pAHU0o862p1gcdhBuk/n2DB8HFSk5MJbytDz0KzxgEDrqhFO4AIeAVq6//wXPnym
nxNTY/6MQazc+S+coiNvBAtr1sT6CWgHsd0DLLQh/PQZ1DVDKRfufd9LfI7PdPFH
gjHp81MArk39vFM5vT01Ac0aG4pj8kTwpTHwt84VL05hj6R/GcB56/526fmmgnan
6KlwufXZkZjP6lteIeidK9NVOhRId5VEL0EguQAc5z8cavl6oD1P+AaECZct+h5r
jMHxeQSf0ggQL6zRGBOU6Dlt2+Cg4FjRpWO8iGe0PlZb+XTFUsPk8/OWEKHa2Rlp
tXhMnEfhzvKZLMg53D+S
=qRMf
-----END PGP SIGNATURE-----
prev parent reply other threads:[~2012-07-27 8:10 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-07-26 15:30 Xen Security Advisory 10 - HVM guest user mode MMIO emulation DoS Xen.org security team
[not found] ` <20497.25251.118584.533875-msK/Ju9w1zmnROeE8kUsYhEHtJm+Wo+I@public.gmane.org>
2012-07-27 8:10 ` Kurt Seifried [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=50124CDC.70401@redhat.com \
--to=kseifried-h+wxahxf7alqt0dzr+alfa@public.gmane.org \
--cc=oss-security-ZwoEplunGu1jrUoiu81ncdBPR1lH4CV8@public.gmane.org \
--cc=security-LM2mM/qkH7s@public.gmane.org \
--cc=xen-announce-GuqFBffKawuULHF6PoxzQEEOCMrvLtNR@public.gmane.org \
--cc=xen-devel-GuqFBffKawuULHF6PoxzQEEOCMrvLtNR@public.gmane.org \
--cc=xen-users-GuqFBffKawuULHF6PoxzQEEOCMrvLtNR@public.gmane.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).