Re: [Xen-devel] Xen security advisory CVE-2011-1898 - VT-d (PCI passthrough) MSI

[Tim Deegan <Tim.Deegan@xxxxxxxxxx>]

At 13:29 +0100 on 13 May (1305293351), Jan Beulich wrote:
> So are you saying that the memory transaction triggering the MSI is
> indistinguishable from any other DMA operation? Implying that the
> guest must be granted access to the page containing the MSI
> address the device is to write to? If so, the changes done as a
> result of your report are only addressing a (very?) small subset of
> bad things such a guest could do.

Yes, and yes.  The only real fix is for the hardware to do interrupt
remapping, and the hypervisor to enforce it.  The patches that go with
the advisory only reduce a full exploit to a DoS (and so, whether you
kill all device-owning domains or the whole hypervisor is pretty much
moot).

Cheers,

Tim.

-- 
Tim Deegan <Tim.Deegan@xxxxxxxxxx>
Principal Software Engineer, Xen Platform Team
Citrix Systems UK Ltd.  (Company #02937203, SL9 0BG)

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-devel