[Xen-devel] XSA-300 Wording

[Doug Goldstein <cardoe@xxxxxxxxxx>]

Could we look at updating the wording of XSA-300 to make things a bit 
more clear. I don't have exact wording suggestions but roughly some of 
the questions I've fielded are:

1. Impact should make it clear there are two issues here. So its really 
"and/or". Or a bulleted list.
2. Vulnerable Systems. "All versions of Linux are vulnerable" does this 
apply to guests. Only reason that was asked is because the next sentence 
goes on to discuss dom0. Are people that didn't pass a "dom0_mem=" on a 
PV dom0 vulnerable or not?
3. Mitigation. Is there no mitigation for PVH dom0's? There's some 
handwaving around "sufficiently large". Large is subjective to folks. If 
I operate with machines with 8GB of RAM day in and day out then my 
definition of "large" is different from someone that operates on 
machines with 256GB of RAM day in and day out.
4. Resolution. There's two issues here (as the Impact should make 
clear). Identify that the patch handles issue "#1" while issue "#2" is 
not fixed yet.

I hope this is a reasonable request.

--

Doug


_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxxx
https://lists.xenproject.org/mailman/listinfo/xen-devel