Xen project Mailing List

[Xen-devel] Xen Security Advisory 187 (CVE-2016-7094) - x86 HVM: Overflow of sh_ctxt->seg_reg[]

To: xen-announce@xxxxxxxxxxxxx, xen-devel@xxxxxxxxxxxxx, xen-users@xxxxxxxxxxxxx, oss-security@xxxxxxxxxxxxxxxxxx

From: Xen.org security team <security@xxxxxxx>

Date: Thu, 08 Sep 2016 12:05:00 +0000

Cc: "Xen.org security team" <security@xxxxxxx>

Delivery-date: Thu, 08 Sep 2016 12:05:44 +0000

List-id: Xen developer discussion <xen-devel.lists.xen.org>

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Xen Security Advisory CVE-2016-7094 / XSA-187 version 3 x86 HVM: Overflow of sh_ctxt->seg_reg[] UPDATES IN VERSION 3 ==================== Fix the backports xsa187-4.6-0002-*.patch and xsa187-4.4-0002-*.patch. In v1 and v2 these did not compile in debug builds. (Debug builds should not be used in production.) Public release. ISSUE DESCRIPTION ================= x86 HVM guests running with shadow paging use a subset of the x86 emulator to handle the guest writing to its own pagetables. There are situations a guest can provoke which result in exceeding the space allocated for internal state. IMPACT ====== A malicious HVM guest administrator can cause Xen to fail a bug check, causing a denial of service to the host. VULNERABLE SYSTEMS ================== All versions of Xen are vulnerable. The vulnerability is only exposed to HVM guests on x86 hardware, which are configured to run with shadow paging. The vulnerability is not exposed to x86 PV guests, x86 HVM guests running with hardware assisted paging, or ARM guests. x86 HVM guests run in HAP mode by default on modern CPUs. To discover whether your HVM guests are using HAP, or shadow page tables: request debug key `q' (from the Xen console, or with `xl debug-keys q'). This will print (to the console, and visible in `xl dmesg'), debug information for every domain, containing something like this: (XEN) General information for domain 2: (XEN) refcnt=1 dying=2 pause_count=2 (XEN) nr_pages=2 xenheap_pages=0 shared_pages=0 paged_pages=0 dirty_cpus={} max_pages=262400 (XEN) handle=ef58ef1a-784d-4e59-8079-42bdee87f219 vm_assist=00000000 (XEN) paging assistance: hap refcounts translate external ^^^ The presence of `hap' here indicates that the host is not vulnerable to this domain. For an HVM domain the presence of `shadow' indicates that the domain can exploit the vulnerability. MITIGATION ========== Running only PV guests will avoid this vulnerability. On hardware which supports Hardware Assisted Paging, configuring the guests to not run with shadow paging will avoid this vulnerability. CREDITS ======= This issue was discovered by Andrew Cooper of Citrix. RESOLUTION ========== Applying the first patch will resolve this issue. The second patch provides additional assurance that the vulnerability is truly eliminated and that there are no related problems. If hotpatching, applying only the first patch is recommended since the second patch is awkward for hotpatching. If deploying new builds, applying both patches is recommended. Xen version First patch Second patch xen-unstable: xsa187-0001-*.patch xsa187-0002-*.patch Xen 4.7.x: xsa187-4.7-0001-*.patch xsa187-4.7-0002-*.patch Xen 4.6.x: xsa187-4.7-0001-*.patch xsa187-4.6-0002-*.patch Xen 4.5.x: xsa187-4.7-0001-*.patch xsa187-4.6-0002-*.patch Xen 4.4.x: xsa187-4.7-0001-*.patch xsa187-4.4-0002-*.patch $ sha256sum xsa187* 65205ee195699d65884af04083ffb86c6ddbc96cbca3141c87f6b2d671de45a3 xsa187-0001-x86-shadow-Avoid-overflowing-sh_ctxt-seg_reg.patch f90e6d13385fb9219e1e26e3a148d1670aefc7130e0639415d08bbb6a1d9efee xsa187-0002-x86-segment-Bounds-check-accesses-to-emulation-ctxt-.patch 727b18ae83001f7ea04613aa7199ada3e6a84939aa44516f7c426e609d383b2a xsa187-4.4-0002-x86-segment-Bounds-check-accesses-to-emulation-ctx.patch b96731379ea77d49ffff31d969f4742dde985ef7a86af9422dcac8327c2a1916 xsa187-4.6-0002-x86-segment-Bounds-check-accesses-to-emulation-ctx.patch be9fe85d36c2c1fbca246c1f4d834c3ef11b6ab3d5467da0ac8c079aa5a68de9 xsa187-4.7-0001-x86-shadow-Avoid-overflowing-sh_ctxt-seg.patch 36b22d6a168be39f31a1c1304f708269a2a10fe5105f7da4a06877d6059f1cd6 xsa187-4.7-0002-x86-segment-Bounds-check-accesses-to-emulation-ctx.patch $ DEPLOYMENT DURING EMBARGO ========================= Deployment of the "reconfigure to use HAP" MITIGATION is NOT permitted (except where all the affected systems and VMs are administered and used only by organisations which are members of the Xen Project Security Issues Predisclosure List). Specifically, deployment on public cloud systems is NOT permitted. This is because the mitigation result in guest-visible changes. Deployment of this mitigation is permitted only AFTER the embargo ends. Deployment of the PATCHES described above (or others which are substantially similar) is permitted during the embargo, even on public-facing systems with untrusted guest users and administrators. But: Distribution of updated software is prohibited (except to other members of the predisclosure list). Predisclosure list members who wish to deploy significantly different patches and/or mitigations, please contact the Xen Project Security Team. (Note: this during-embargo deployment notice is retained in post-embargo publicly released Xen Project advisories, even though it is then no longer applicable. This is to enable the community to have oversight of the Xen Project Security Team's decisionmaking.) For more information about permissible uses of embargoed information, consult the Xen Project community's agreed Security Policy: http://www.xenproject.org/security-policy.html -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQEcBAEBAgAGBQJX0VPlAAoJEIP+FMlX6CvZeIQIALJEH1stiHZLs2Kc8AKTTbUh ZM3pGSUYC9AFMpn3ovuXgOJjYfX1YY89nAOKlDKuiPaaUz01mmqWXGBDBmqZ1IU0 9BjPfnnMYoqeHcrjz0+KajSO6kf/iepUdUx1IiduA48k/7VUvqU8P/s/UiutXerF YvHcc+a6lLIPPcXjWW6ftSEagGHUmB+qcHh4aptxVq/xEdIQysAGtUU7MMG9ihsN VY3MN6aQiIFRr56ICZJ7K+s9Rw+xWfOVXj8FZAoq2mDPns6pQT0obyCrIbfQcywA 6GMXWXVf4vSR/dgQm8xD95/3gFPd1IfuwxjOvHkfJlqxxCfa8JT6oVsQfZskhhs= =/Mbl -----END PGP SIGNATURE-----

_______________________________________________ Xen-devel mailing list Xen-devel@xxxxxxxxxxxxx https://lists.xen.org/xen-devel

©2013 Xen Project, A Linux Foundation Collaborative Project. All Rights Reserved.
Linux Foundation is a registered trademark of The Linux Foundation.
Xen Project is a trademark of The Linux Foundation.