From mboxrd@z Thu Jan  1 00:00:00 1970
From: Keir Fraser <keir.fraser@eu.citrix.com>
Subject: Re: Xen 4.0.0x allows for data corruption in Dom0
Date: Sat, 06 Mar 2010 13:36:15 +0000
Message-ID: <C7B80ACF.C5EE%keir.fraser@eu.citrix.com>
References: <C7B7F4C4.C5D8%keir.fraser@eu.citrix.com>
Mime-Version: 1.0
Content-Type: text/plain;
	charset="US-ASCII"
Content-Transfer-Encoding: 7bit
Return-path: <xen-devel-bounces@lists.xensource.com>
In-Reply-To: <C7B7F4C4.C5D8%keir.fraser@eu.citrix.com>
List-Unsubscribe: <http://lists.xensource.com/mailman/listinfo/xen-devel>,
	<mailto:xen-devel-request@lists.xensource.com?subject=unsubscribe>
List-Post: <mailto:xen-devel@lists.xensource.com>
List-Help: <mailto:xen-devel-request@lists.xensource.com?subject=help>
List-Subscribe: <http://lists.xensource.com/mailman/listinfo/xen-devel>,
	<mailto:xen-devel-request@lists.xensource.com?subject=subscribe>
Sender: xen-devel-bounces@lists.xensource.com
Errors-To: xen-devel-bounces@lists.xensource.com
To: Joanna Rutkowska <joanna@invisiblethingslab.com>, "xen-devel@lists.xensource.com" <xen-devel@lists.xensource.com>
List-Id: xen-devel@lists.xenproject.org

On 06/03/2010 12:02, "Keir Fraser" <keir.fraser@eu.citrix.com> wrote:

> On 06/03/2010 10:12, "Joanna Rutkowska" <joanna@invisiblethingslab.com>
> wrote:
> 
>> It's really interesting how much control does the VM have over the data
>> (and location) that are corrupted in Dom0 -- if it has any control, then
>> it might allow for an interesting VM escape attack perhaps :)
>> 
>> Unfortunately we don't have time to investigate this problem any further
>> in our lab.
> 
> Thanks, I'll see if I can repro with your simple setup. It's an interesting
> one since presumably the domU is not doing much other waiting on its
> rootdelay timeout when the corruption manifests. Sounds like the dom0 kernel
> version doesn't matter at all?

Tried a few times and no luck reproducing so far. I hope some other people
on the list also will give it a go, since it's so easy to try it out.

 -- Keir