[Xen-devel] Xen Security Advisory 87 - PHYSDEVOP_{prepare, release}_msix exposed to unprivileged guests

[Xen.org security team <security@xxxxxxx>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

                   Xen Security Advisory XSA-87

     PHYSDEVOP_{prepare,release}_msix exposed to unprivileged guests

ISSUE DESCRIPTION
=================

The PHYSDEVOP_{prepare,release}_msix operations are supposed to be available
to privileged guests (domain 0 in non-disaggregated setups) only, but the
necessary privilege check was missing.

IMPACT
======

Malicious or misbehaving unprivileged guests can cause the host or other
guests to malfunction. This can result in host-wide denial of service.
Privilege escalation, while seeming to be unlikely, cannot be excluded.

VULNERABLE SYSTEMS
==================

Xen 4.1.5 and 4.1.6.1 as well as 4.2.2 and later are vulnerable.
Xen 4.2.1 and 4.2.0 as well as 4.1.4 and earlier are not vulnerable.

Only PV guests can take advantage of this vulnerability.

MITIGATION
==========

Running only HVM guests will avoid this issue.

There is no mitigation available for PV guests.

NOTE REGARDING LACK OF EMBARGO
==============================

This issue was disclosed publicly on the xen-devel mailing list.

RESOLUTION
==========

Applying the appropriate attached patch resolves this issue.

xsa87-unstable-4.3.patch    xen-unstable, Xen 4.3.x
xsa87-4.2.patch             Xen 4.2.x
xsa87-4.1.patch             Xen 4.1.x

$ sha256sum xsa87*.patch
45e5cc892626293067cc088a671a6bbdc18b018f54ff09b6a1cbb1fabbdf114d  
xsa87-4.1.patch
df9c1507d7bb0e5266a2fadd992d1e6ed0f7bf5be7466b8a93ed3bd8e3ab8e8d  
xsa87-4.2.patch
a13ce270b177d33537d627b85471abaa01215cd458541f4c6524914d7c81eb38  
xsa87-unstable-4.3.patch
$
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iQEcBAEBAgAGBQJS4TtaAAoJEIP+FMlX6CvZd+IH/i2WTmxuMRe4znSrGg2JJE1L
Wx3ioEKGnU/+5n2T94radln7lA85QvQJpIhwK6aA+BrPYhbtLKI5cq+d5LQ+RLmM
4YUvKZuoolyaHUZSs6XZCopExCz537CCW+rAPhUEGYgP6sLr5aGEG0x8AQimDAJX
YwlF1MqhfxYyWWI6xplzBo3ZoKlMQNikGOQN9isBF5J6ygQZYBgyfeK/M8C7PZlp
GAtVfLNYhbMuZLCJpUcrei7QXSERKf++Li7Vfc6WOZ4OzqPysNrJmMVlPwe/k9RZ
ldNznuYNsTV6WNl/SB4u6W1iygvYhXk4t1xyzIDlmVP+GwsHtuFW9IFiV2aZohc=
=ekUq
-----END PGP SIGNATURE-----

Attachment: xsa87-4.1.patch
Description: Binary data

Attachment: xsa87-4.2.patch
Description: Binary data

Attachment: xsa87-unstable-4.3.patch
Description: Binary data

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
http://lists.xen.org/xen-devel