[Xen-devel] Xen Security Advisory 240 (CVE-2017-15595) - Unlimited recursion in linear pagetable de-typing

[Xen.org security team <security@xxxxxxx>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

            Xen Security Advisory CVE-2017-15595 / XSA-240
                               version 5

           Unlimited recursion in linear pagetable de-typing

UPDATES IN VERSION 5
====================

New final patch, addressing an issue found with the original fix,
which cannot be excluded to be by itself another security issue (not
fully addressing the original issue); crashes (assertion failures)
have been observed with custom debug builds of patched hypervisors.

ISSUE DESCRIPTION
=================

x86 PV guests are permitted to set up certain forms of what is often
called "linear page tables", where pagetables contain references to
other pagetables at the same level or higher.  Certain restrictions
apply in order to fit into Xen's page type handling system.  An
important restriction was missed, however: Stacking multiple layers
of page tables of the same level on top of one another is not very
useful, and the tearing down of such an arrangement involves
recursion.  With sufficiently many layers such recursion will result
in a stack overflow, commonly resulting in Xen to crash.

IMPACT
======

A malicious or buggy PV guest may cause the hypervisor to crash,
resulting in Denial of Service (DoS) affecting the entire host.
Privilege escalation and information leaks cannot be excluded.

VULNERABLE SYSTEMS
==================

All Xen versions from at least 3.2 onwards are vulnerable.  Earlier
versions have not been checked.

Only x86 systems are affected.  ARM systems are not affected.

Only x86 PV guests can leverage the vulnerability.  x86 HVM guests
cannot leverage the vulnerability.

MITIGATION
==========

Running only HVM guests will avoid this vulnerability.

For PV guests, the vulnerability can be avoided if the guest kernel is
controlled by the host rather than guest administrator, provided that
further steps are taken to prevent the guest administrator from loading
code into the kernel (e.g. by disabling loadable modules etc) or from
using other mechanisms which allow them to run code at kernel privilege.

CREDITS
=======

This issue was discovered by Jann Horn of Google Project Zero.

RESOLUTION
==========

Applying the appropriate attached patch series resolves this issue.
The first patch fixes this known issue.  The second, optional, patch
in each series disables the `linear pagetable` option by default.  It
can be re-enabled by adding "pv-linear-pt=true' on the Xen
command-line.

Note that neither Linux nor MiniOS use linear pagetables; NetBSD and
Novell Netware, however, do use this feature when running in PV mode.

xsa240-unstable/*.patch  xen-unstable
xsa240-4.9/*.patch       Xen 4.9.x
xsa240-4.8/*.patch       Xen 4.8.x
xsa240-4.7/*.patch       Xen 4.7.x
xsa240-4.6/*.patch       Xen 4.6.x
xsa240-4.5/*.patch       Xen 4.5.x

$ sha256sum xsa240*/*
e227126ea204d6049c8bfb694e3d2bcac10382733ca4ece1f0f7dc36c625ac1d  
xsa240-unstable/0001-x86-limit-linear-page-table-use-to-a-single-level.patch
c6bb1f47754bf4f57bb9205509c525336ff55da8bcae8ae95415bdf1bba70209  
xsa240-unstable/0002-x86-mm-Disable-PV-linear-pagetables-by-default.patch
549f56c7a3eacd1fc308a46ac5db32f2191d67e7e25aff501fb2ba26cc979feb  
xsa240-unstable/0003-x86-dont-wrongly-trigger-linear-page-table-assertion.patch
2e8168449f8594c5faa50feb311eaa7e74b38c726853b1cfbaf2fbd4cbbdb476  
xsa240-4.5/0001-x86-limit-linear-page-table-use-to-a-single-level.patch
ea95ed56a5f85753a41ca1abbb4abd5ea791d7596c8a9d20ceaa53862ee5ce15  
xsa240-4.5/0002-x86-mm-Disable-PV-linear-pagetables-by-default.patch
76ba9206fbab686cc8c3b8b21945532b7029cc4725ee1cc38666035152ba87ad  
xsa240-4.5/0003-x86-dont-wrongly-trigger-linear-page-table-assertion.patch
f7556cc4a13cd4334d79e73861f15dd619dfd6041a3ad89865b358035d2fcff8  
xsa240-4.6/0001-x86-limit-linear-page-table-use-to-a-single-level.patch
24ad9f92938c112a6fcf46177d44597c49dc213a3644ce4fd59d4df507b072d3  
xsa240-4.6/0002-x86-mm-Disable-PV-linear-pagetables-by-default.patch
2fe49415a8925dda416fd2594f935ec03c8070bea4a049c1ad242c646fef01e1  
xsa240-4.6/0003-x86-dont-wrongly-trigger-linear-page-table-assertion.patch
5a9b8e0a4e55482826e6cf820ea01fbf6674fecf19b101f4578396e3fa98a8fd  
xsa240-4.7/0001-x86-limit-linear-page-table-use-to-a-single-level.patch
acf9744b853c1c6ac071bcf5776d8d9463781bbdf658c2fecc59ee338c094750  
xsa240-4.7/0002-x86-mm-Disable-PV-linear-pagetables-by-default.patch
637ef53ca2d6633104abff47be208d87836042af79082666cb818f0ad53b6452  
xsa240-4.7/0003-x86-dont-wrongly-trigger-linear-page-table-assertion.patch
c0c624f51fb1bd9e31a2c120343164d545ab6e709ed4bb9e5dd89b5c4c4e49f8  
xsa240-4.8/0001-x86-limit-linear-page-table-use-to-a-single-level.patch
7e3c2c4a4d0ee0a29abaa7aceffbb774b1f92aa81dfa4c5d1c5c5156b6bb0a3a  
xsa240-4.8/0002-x86-mm-Disable-PV-linear-pagetables-by-default.patch
f174ee608a7f7f0601ae46edafbf443c90a87632609c1b4145fb0e2e5c4b1b51  
xsa240-4.8/0003-x86-dont-wrongly-trigger-linear-page-table-assertion.patch
7769866805e47b7a2109ba1778f263ddfa126bcb0b116612f76dfaca9bf70995  
xsa240-4.9/0001-x86-limit-linear-page-table-use-to-a-single-level.patch
1053cb348dc8536cb12b4aca556ddc4c015810f8f0fd21a80dff37433ec082ea  
xsa240-4.9/0002-x86-mm-Disable-PV-linear-pagetables-by-default.patch
4b312010962a294660b2e78a9a5bfd9d537000ceda11e587f88fc49da560c0ff  
xsa240-4.9/0003-x86-dont-wrongly-trigger-linear-page-table-assertion.patch
$

DEPLOYMENT DURING EMBARGO
=========================

Deployment of the patches and/or mitigations described above (or
others which are substantially similar) is permitted during the
embargo, even on public-facing systems with untrusted guest users and
administrators.

But: Distribution of updated software is prohibited (except to other
members of the predisclosure list).

Predisclosure list members who wish to deploy significantly different
patches and/or mitigations, please contact the Xen Project Security
Team.

(Note: this during-embargo deployment notice is retained in
post-embargo publicly released Xen Project advisories, even though it
is then no longer applicable.  This is to enable the community to have
oversight of the Xen Project Security Team's decisionmaking.)

For more information about permissible uses of embargoed information,
consult the Xen Project community's agreed Security Policy:
  http://www.xenproject.org/security-policy.html
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQEcBAEBCAAGBQJaDHWkAAoJEIP+FMlX6CvZzoIH/A+QwWwCj2ZFY1XyTpVlRemk
oBSRnZiKNin1L8a76gd0pmOUw4oN/bbsZyYIB3A7KvOiVQJ1SlQEyX1oQaDtRj4a
VEssmyKQ5tT6c0OWB2MWI5Pgzfr6fjFEtjlK+5sXx2I9ZlgZH1rzkaBZVDpWfDXD
Ts6+gBGA8UmmTsRGhOBhXYql+y6kZe+V1ug8hrOUAj21Hx6D7qZXBp8FztflOOa6
9gMcckRQN/7LZYaVCA2knivD33xohveR3XRpIbtRTZ6jy69xBlvk3gxfKc8jrLnd
6Uzhhn0Wbomz+v1ePD0ZsdQkbDTTZ4IdotWdYSSEAgw7xuRS46Q+YOs9ZCytsLI=
=NMKG
-----END PGP SIGNATURE-----

Attachment: xsa240-unstable/0001-x86-limit-linear-page-table-use-to-a-single-level.patch
Description: Binary data

Attachment: xsa240-unstable/0002-x86-mm-Disable-PV-linear-pagetables-by-default.patch
Description: Binary data

Attachment: xsa240-unstable/0003-x86-dont-wrongly-trigger-linear-page-table-assertion.patch
Description: Binary data

Attachment: xsa240-4.5/0001-x86-limit-linear-page-table-use-to-a-single-level.patch
Description: Binary data

Attachment: xsa240-4.5/0002-x86-mm-Disable-PV-linear-pagetables-by-default.patch
Description: Binary data

Attachment: xsa240-4.5/0003-x86-dont-wrongly-trigger-linear-page-table-assertion.patch
Description: Binary data

Attachment: xsa240-4.6/0001-x86-limit-linear-page-table-use-to-a-single-level.patch
Description: Binary data

Attachment: xsa240-4.6/0002-x86-mm-Disable-PV-linear-pagetables-by-default.patch
Description: Binary data

Attachment: xsa240-4.6/0003-x86-dont-wrongly-trigger-linear-page-table-assertion.patch
Description: Binary data

Attachment: xsa240-4.7/0001-x86-limit-linear-page-table-use-to-a-single-level.patch
Description: Binary data

Attachment: xsa240-4.7/0002-x86-mm-Disable-PV-linear-pagetables-by-default.patch
Description: Binary data

Attachment: xsa240-4.7/0003-x86-dont-wrongly-trigger-linear-page-table-assertion.patch
Description: Binary data

Attachment: xsa240-4.8/0001-x86-limit-linear-page-table-use-to-a-single-level.patch
Description: Binary data

Attachment: xsa240-4.8/0002-x86-mm-Disable-PV-linear-pagetables-by-default.patch
Description: Binary data

Attachment: xsa240-4.8/0003-x86-dont-wrongly-trigger-linear-page-table-assertion.patch
Description: Binary data

Attachment: xsa240-4.9/0001-x86-limit-linear-page-table-use-to-a-single-level.patch
Description: Binary data

Attachment: xsa240-4.9/0002-x86-mm-Disable-PV-linear-pagetables-by-default.patch
Description: Binary data

Attachment: xsa240-4.9/0003-x86-dont-wrongly-trigger-linear-page-table-assertion.patch
Description: Binary data

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
https://lists.xen.org/xen-devel