Xen Security Advisory 419 v2 (CVE-2022-42322,CVE-2022-42323) - Xenstore: Cooperating guests can create arbitrary numbers of nodes

[Xen.org security team <security@xxxxxxx>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

     Xen Security Advisory CVE-2022-42322,CVE-2022-42323 / XSA-419
                               version 2

   Xenstore: Cooperating guests can create arbitrary numbers of nodes

UPDATES IN VERSION 2
====================

Public release.

ISSUE DESCRIPTION
=================

Since the fix of XSA-322 any Xenstore node owned by a removed domain
will be modified to be owned by Dom0.  This will allow two malicious
guests working together to create an arbitrary number of Xenstore
nodes.

This is possible by domain A letting domain B write into domain A's
local Xenstore tree.  Domain B can then create many nodes and reboot.
The nodes created by domain B will now be owned by Dom0.  By repeating
this process over and over again an arbitrary number of nodes can be
created, as Dom0's number of nodes isn't limited by Xenstore quota.

IMPACT
======

Two malicious guests working together can drive xenstored into an
out of memory situation, resulting in a Denial of Service (DoS) of
xenstored.

This inhibits creation of new guests and changing the configuration of
already running guests.

VULNERABLE SYSTEMS
==================

All versions of Xen with the fix for XSA-322 are in principle vulnerable.

Both Xenstore implementations (C and Ocaml) are vulnerable.

MITIGATION
==========

There is no mitigation available.

CREDITS
=======

This issue was discovered by Jürgen Groß of SUSE.

RESOLUTION
==========

Applying the appropriate attached patch resolves this issue.

Note that patches for released versions are generally prepared to
apply to the stable branches, and may not apply cleanly to the most
recent release tarball.  Downstreams are encouraged to update to the
tip of the stable branch before applying these patches.

xsa419/xsa419-oxenstored.patch             xen-unstable
xsa419/xsa419-xenstored-??.patch           xen-unstable, Xen 4.16.x
xsa419/xsa419-4.15-oxenstored.patch        Xen 4.15.x
xsa419/xsa419-4.15-xenstored-??.patch      Xen 4.15.x
xsa419/xsa419-4.14-oxenstored.patch        Xen 4.14.x
xsa419/xsa419-4.14-xenstored-??.patch      Xen 4.14.x
xsa419/xsa419-4.13-oxenstored.patch        Xen 4.13.x
xsa419/xsa419-4.13-xenstored-??.patch      Xen 4.13.x

$ sha256sum xsa419* xsa419*/*
eaeb2a67accac70743cd9bed055b31bee2402600b7452f79da4bb969d7b5607f  xsa419.meta
34abd947ceaf1251afc81356a3ff374bc06c046651f5f9d0894d90c93295d1ca  
xsa419/xsa419-4.13-oxenstored.patch
713eea1d9be7a5bef7a681a10648d2ea7db36c961cc8a9c55e147db14f59fbc2  
xsa419/xsa419-4.13-xenstored-01.patch
d7b0369ee1c87a08783c0484ae5f62f1c61be9c405e6568085052867bb520b2a  
xsa419/xsa419-4.13-xenstored-02.patch
f6e0cd7491d602db3a7ac9b9e94afb59c30bf8690cd116850d8eafc481f022a9  
xsa419/xsa419-4.13-xenstored-03.patch
18daa2d6b9d243bfd81e221af9ae1d74cbc621614b78dc751bb6ccdba3d66451  
xsa419/xsa419-4.14-oxenstored.patch
d631f12da2a8fcf674aeed33d0037bfff4b11587d6d52e4709739a8d1e90f33a  
xsa419/xsa419-4.14-xenstored-01.patch
dc3834b30ac15d31ad1a13a8b4925229f13ce7955f2cc2223651764c55d41e64  
xsa419/xsa419-4.14-xenstored-02.patch
f15d02bfc9ee5119347708fd2e4d26c6b4aa18827afab1a10b9139344ca88861  
xsa419/xsa419-4.14-xenstored-03.patch
95c35f32cf64229df2768109acc360a6f6ec4ddfdcbde4f0d8165f67432d3eef  
xsa419/xsa419-4.15-oxenstored.patch
773e98ee9ddb37e4a743d4435340066aabdc5fb41b6ff12e6b91c709484204ab  
xsa419/xsa419-4.15-xenstored-01.patch
4d1f9135be43e121576909787a6403aa1c1e5fa72ead8764326e21beb48d83d4  
xsa419/xsa419-4.15-xenstored-02.patch
484bdddae7a750cbddeddb93be5840e3cfdda5799f667c6b5d66c3c9b7217d55  
xsa419/xsa419-4.15-xenstored-03.patch
1c790ddc8cbabb32012c7636c46e017b0cbdd1cc23c56baabda4d5dca9531454  
xsa419/xsa419-oxenstored.patch
3c53e103f7927ae28ab5c7a3954c7d0a6fbbdce0340816936adb5938cd48c776  
xsa419/xsa419-xenstored-01.patch
978e3100b20e0126ee238d3e1c2036b25582b1c3333a028e120d700bac8d2a13  
xsa419/xsa419-xenstored-02.patch
57f7015289a940e7f2dc66aedb1c04d37d0aef687a7b91453582e960b7f93076  
xsa419/xsa419-xenstored-03.patch
$

DEPLOYMENT DURING EMBARGO
=========================

Deployment of patches or mitigations is NOT permitted (except where
all the affected systems and VMs are administered and used only by
organisations which are members of the Xen Project Security Issues
Predisclosure List).  Specifically, deployment on public cloud systems
is NOT permitted.

This is because the patches will result in a guest visible change of
behavior of Xenstore.

Deployment is permitted only AFTER the embargo ends.


(Note: this during-embargo deployment notice is retained in
post-embargo publicly released Xen Project advisories, even though it
is then no longer applicable.  This is to enable the community to have
oversight of the Xen Project Security Team's decisionmaking.)

For more information about permissible uses of embargoed information,
consult the Xen Project community's agreed Security Policy:
  http://www.xenproject.org/security-policy.html
-----BEGIN PGP SIGNATURE-----

iQFABAEBCAAqFiEEI+MiLBRfRHX6gGCng/4UyVfoK9kFAmNg+64MHHBncEB4ZW4u
b3JnAAoJEIP+FMlX6CvZR4gIAI+TcWgMKtaJ6G6MeakBbgxliMCO7+C01+94H6ZH
7dC57n3Qm12t3q6WGnPG1YYzKGWT2hsSU8/JtIkuZFe2qyvuG5cVhVcrdOGGkhsZ
4ui517R76Ldb/cBtraX6QRJni+T58ZdQGAChr6KuD8cyMgXAl1gtto9+/rQtsDzr
7XxKcR/+CcNWAOpZTNJ6DtS8V1RuRNtMSuoTCpC3Ph+Edir05bPlz6BF8EnV0cqU
+Jk9nYHGg5H11L0K+yx4cIAWfaP/n/Z2AoND23tV3T4o3U3zQR9xNBvcY1zuvioG
rEfzGNQx9ECQLHYPTzHNNWs+9Fb8eHyiRvkS6SKGolxpj9A=
=nNvr
-----END PGP SIGNATURE-----

Attachment: xsa419.meta
Description: Binary data

Attachment: xsa419/xsa419-4.13-oxenstored.patch
Description: Binary data

Attachment: xsa419/xsa419-4.13-xenstored-01.patch
Description: Binary data

Attachment: xsa419/xsa419-4.13-xenstored-02.patch
Description: Binary data

Attachment: xsa419/xsa419-4.13-xenstored-03.patch
Description: Binary data

Attachment: xsa419/xsa419-4.14-oxenstored.patch
Description: Binary data

Attachment: xsa419/xsa419-4.14-xenstored-01.patch
Description: Binary data

Attachment: xsa419/xsa419-4.14-xenstored-02.patch
Description: Binary data

Attachment: xsa419/xsa419-4.14-xenstored-03.patch
Description: Binary data

Attachment: xsa419/xsa419-4.15-oxenstored.patch
Description: Binary data

Attachment: xsa419/xsa419-4.15-xenstored-01.patch
Description: Binary data

Attachment: xsa419/xsa419-4.15-xenstored-02.patch
Description: Binary data

Attachment: xsa419/xsa419-4.15-xenstored-03.patch
Description: Binary data

Attachment: xsa419/xsa419-oxenstored.patch
Description: Binary data

Attachment: xsa419/xsa419-xenstored-01.patch
Description: Binary data

Attachment: xsa419/xsa419-xenstored-02.patch
Description: Binary data

Attachment: xsa419/xsa419-xenstored-03.patch
Description: Binary data