[Xen-devel] Xen Security Advisory 276 v2 - resource accounting issues in x86 IOREQ server handling

[Xen.org security team <security@xxxxxxx>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

                    Xen Security Advisory XSA-276
                              version 2

        resource accounting issues in x86 IOREQ server handling

UPDATES IN VERSION 2
====================

Public release.

ISSUE DESCRIPTION
=================

Allocation of pages used to communicate with external emulators did not
follow certain principles that are required for proper life cycle
management of guest exposed pages.

IMPACT
======

A compromised DM stubdomain may cause Xen to crash, resulting in a DoS
(Denial of Service) affecting the entire host.  Privilege escalation
as well as information leaks cannot be ruled out.

VULNERABLE SYSTEMS
==================

Only Xen 4.11 is affected by this vulnerability.  Xen 4.10 and older are
not affected by this vulnerability.

Only systems running HVM guests with their devicemodels in a
stubdomain are considered vulnerable.  Note that attackers also need
to exploit the devicemodel in order to have access to this
vulnerability.

Arm guests cannot leverage this vulnerability.

MITIGATION
==========

Running only PV guests will avoid this vulnerability.

(The security of a Xen system using stub domains is still better than
with a qemu-dm running as an unrestricted dom0 process.  Therefore
users with these configurations should not switch to an unrestricted
dom0 qemu-dm.)

CREDITS
=======

This issue was discovered by Julien Grall of ARM.

RESOLUTION
==========

Applying the appropriate set of attached patches resolves this issue.

xsa276/*.patch           xen-unstable
xsa276-4.11/*.patch        Xen 4.11.x

$ sha256sum xsa276* xsa276*/*
efe9f031c5646b111cbfbe35141a7d99eb31ead07c1c6051145abbd9a3def5b9  xsa276.meta
7f77225e3de780a2507714caab5870664634bf9f76215547bebd31a6399a86ef  
xsa276-4.11/0001-x86-hvm-ioreq-fix-page-referencing.patch
c93c66090009833cd11fabe72b523cbdb3467fa104cc97d1855d365881aa7f8e  
xsa276-4.11/0002-x86-hvm-ioreq-use-ref-counted-target-assigned-shared.patch
ef8b89375866821f4a612f600d10834bf65d811b1784a4ee0fde4a3a409501e0  
xsa276/0001-x86-hvm-ioreq-fix-page-referencing.patch
75398ec343b9aaebf0c7dc0c5ef5ed7a3f3be0959f1519db5c7f32c44e7a54d3  
xsa276/0002-x86-hvm-ioreq-use-ref-counted-target-assigned-shared.patch
$

DEPLOYMENT DURING EMBARGO
=========================

Deployment of the patches and/or mitigations described above (or
others which are substantially similar) is permitted during the
embargo, even on public-facing systems with untrusted guest users and
administrators.

But: Distribution of updated software is prohibited (except to other
members of the predisclosure list).

Predisclosure list members who wish to deploy significantly different
patches and/or mitigations, please contact the Xen Project Security
Team.

(Note: this during-embargo deployment notice is retained in
post-embargo publicly released Xen Project advisories, even though it
is then no longer applicable.  This is to enable the community to have
oversight of the Xen Project Security Team's decisionmaking.)

For more information about permissible uses of embargoed information,
consult the Xen Project community's agreed Security Policy:
  http://www.xenproject.org/security-policy.html
-----BEGIN PGP SIGNATURE-----

iQFABAEBCAAqFiEEI+MiLBRfRHX6gGCng/4UyVfoK9kFAlv0C2kMHHBncEB4ZW4u
b3JnAAoJEIP+FMlX6CvZpssH/1YDoUGry3iCsHZnymWqfWFiuddW2U03UPmq/BH+
tZ+HxnOeibVkvsB8g9POxCkSqS77MiFksgUTc0l6qV9zZ+A7glFRzMbKSSnmobul
ETP/7AM3UO8H4uSji8P3lfN0l1B/BXetitv6FzogOUTP4iCX1TYfS4eu+UUOTWoj
kg3DglZKeLY/eztTnJSOP5VzT09+Ra44IFvCfzz4gMV6Njgj0dZZ1jyBvKNxY3Rs
bKiuycHDAzTGWHR6hymGVR73EowTgaboLEjpXTWVYbBvKv8HUp/v5UBzCf3TuPy6
GmtUaS/mtDPRYcgAjYPddGa7euVL6ESV+FNsSrMneJCBgk4=
=/tEm
-----END PGP SIGNATURE-----

Attachment: xsa276.meta
Description: Binary data

Attachment: xsa276-4.11/0001-x86-hvm-ioreq-fix-page-referencing.patch
Description: Binary data

Attachment: xsa276-4.11/0002-x86-hvm-ioreq-use-ref-counted-target-assigned-shared.patch
Description: Binary data

Attachment: xsa276/0001-x86-hvm-ioreq-fix-page-referencing.patch
Description: Binary data

Attachment: xsa276/0002-x86-hvm-ioreq-use-ref-counted-target-assigned-shared.patch
Description: Binary data

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxxx
https://lists.xenproject.org/mailman/listinfo/xen-devel