RE: [Xen-devel] Xen security advisory CVE-2011-1898 - VT-d (PCI passthrough) MSI

[Ian Jackson <Ian.Jackson@xxxxxxxxxxxxx>]

Cihula, Joseph writes ("RE: [Xen-devel] Xen security advisory CVE-2011-1898 - 
VT-d (PCI passthrough) MSI"):
> Why do you *need* IR to have a secure Xen w/ TXT?  Certainly a DoS
> is very undesirable, but that is not really a security issue.

I'm afraid that a DoS is very much a security issue.

>  Tell me what security exploits are still possible with the current
> patches.

As I understand it, a DoS (host crash) is still possible.

> If someone can present a security issue that TXT

I don't understand the contribution of TXT to this.  The issue is with
running untrusted guest kernels.  Necessarily an untrusted guest
kernel isn't checked by TXT; that's what "untrusted guest kernel"
means.

Ian.

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-devel