Xen Security Advisory 412 v2 (CVE-2022-42327) - x86: unintended memory sharing between guests

[Xen.org security team <security@xxxxxxx>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

            Xen Security Advisory CVE-2022-42327 / XSA-412
                               version 2

               x86: unintended memory sharing between guests

UPDATES IN VERSION 2
====================

Public release.

ISSUE DESCRIPTION
=================

On Intel systems that support the "virtualize APIC accesses" feature, a
guest can read and write the global shared xAPIC page by moving the
local APIC out of xAPIC mode.

Access to this shared page bypasses the expected isolation that should
exist between two guests.

IMPACT
======

Guests are able to access an unintended shared memory page.  Note the
contents of the page are not interpreted by Xen or hardware.

VULNERABLE SYSTEMS
==================

Only Xen version 4.16 is vulnerable.  Other Xen versions are not vulnerable.

x86 HVM or PVH guests running on Intel systems with the "virtualize APIC
accesses" feature are affected.  This is believed to be all 64-bit
capable Intel CPUs.

x86 HVM or PVH guests running on AMD hardware, Arm or x86 PV guests are
not affected.

MITIGATION
==========

Only running PV guests will mitigate the vulnerability on affected
hardware.

CREDITS
=======

This issue was discovered by Andrew Cooper of Citrix.

RESOLUTION
==========

Applying the appropriate attached patch resolves this issue.

Note that patches for released versions are generally prepared to
apply to the stable branches, and may not apply cleanly to the most
recent release tarball.  Downstreams are encouraged to update to the
tip of the stable branch before applying these patches.

xsa412.patch           xen-unstable
xsa412-4.16.patch      Xen 4.16.x

$ sha256sum xsa412*
64107d4a185dc3cdbc59400d724fe2ada490d39c14ab354aa73bb67a94ca0f65  xsa412.meta
425c1cc3e25f67746a3074aa6304dd0d915f503ea57440b9ecdb583e1547a8fe  xsa412.patch
b030bebbc4798e1d1ad75d763294ce25609f9f895402272a1f354d781f6f5f00  
xsa412-4.16.patch
$

DEPLOYMENT DURING EMBARGO
=========================

Deployment of the patches and/or mitigations described above (or
others which are substantially similar) is permitted during the
embargo, even on public-facing systems with untrusted guest users and
administrators.

But: Distribution of updated software is prohibited (except to other
members of the predisclosure list).

Predisclosure list members who wish to deploy significantly different
patches and/or mitigations, please contact the Xen Project Security
Team.
-----BEGIN PGP SIGNATURE-----

iQFABAEBCAAqFiEEI+MiLBRfRHX6gGCng/4UyVfoK9kFAmNg+5sMHHBncEB4ZW4u
b3JnAAoJEIP+FMlX6CvZF10H/2C2pgVmiJWW6iZNMTDHuV4EyZJTFPCBnKR3qirj
3fffRN15gjzPLZZH+Ivwj3ZeWyQBLkGqC1EFemLtWpQePYlcRoH4mCyE4jc8dx89
Ejh2Zfaib0GIJoHqqDYnRQV8/BusGjIRNgWG2zAEuj+ElHRYtXcd4G5/swtcmKyN
/lSn5VMVrTGdfyGmQtcou24fK5sfzDrfCJm8pThUT6x+ERAUtCYWx2SG3fA1x55R
hWc846qJPXay/BOI0F/d23QkOP+jZsCjhbe+xnTEfgGEq32ZvwhFgkz1/DuXHl0j
hBrWjRzhLd8+mCmnXeXURDHbPmyg47TDsSg4n1VeRBJUKrc=
=as4H
-----END PGP SIGNATURE-----

Attachment: xsa412.meta
Description: Binary data

Attachment: xsa412.patch
Description: Binary data

Attachment: xsa412-4.16.patch
Description: Binary data