OVMSA-2015-0058 - xen security update
| Type: | SECURITY |
| Severity: | CRITICAL |
| Release Date: | 2015-05-14 |
Description
[4.1.3-25.el5.127.36.1]
- force the fifo access to be in bounds of the allocated buffer
This is CVE-2015-3456. [bug 21078935] {CVE-2015-3456}
[4.1.3-25.el5.127.36]
- xen: limit guest control of PCI command register
Otherwise the guest can abuse that control to cause e.g. PCIe
Unsupported Request responses (by disabling memory and/or I/O decoding
and subsequently causing [CPU side] accesses to the respective address
ranges), which (depending on system configuration) may be fatal to the
host.
This is CVE-2015-2756 / XSA-126.
Signed-off-by: Jan Beulich
Reviewed-by: Stefano Stabellini
Acked-by: Ian Campbell
Conflicts:
tools/ioemu-remote/hw/pass-through.c
Acked-by: Chuck Anderson
Reviewed-by: Konrad Rzeszutek Wilk [bug 20739381] {CVE-2015-2756}
[4.1.3-25.el5.127.35]
- Limit XEN_DOMCTL_memory_mapping hypercall to only process up to 64 GFNs (or less)
Said hypercall for large BARs can take quite a while. As such
we can require that the hypercall MUST break up the request
in smaller values.
Another approach is to add preemption to it - whether we do the
preemption using hypercall_create_continuation or returning
EAGAIN to userspace (and have it re-invocate the call) - either
way the issue we cannot easily solve is that in 'map_mmio_regions'
if we encounter an error we MUST call 'unmap_mmio_regions' for the
whole BAR region.
Since the preemption would re-use input fields such as nr_mfns,
first_gfn, first_mfn - we would lose the original values -
and only undo what was done in the current round (i.e. ignoring
anything that was done prior to earlier preemptions).
Unless we re-used the return value as 'EAGAIN|nr_mfns_done<<10' but
that puts a limit (since the return value is a long) on the amount
of nr_mfns that can provided.
This patch sidesteps this problem by:
- Setting an hard limit of nr_mfns having to be 64 or less.
- Toolstack adjusts correspondingly to the nr_mfn limit.
- If the there is an error when adding the toolstack will call the
remove operation to remove the whole region.
The need to break this hypercall down is for large BARs can take
more than the guest (initial domain usually) time-slice. This has
the negative result in that the guest is locked out for a long
duration and is unable to act on any pending events.
We also augment the code to return zero if nr_mfns instead
of trying to the hypercall.
Suggested-by: Jan Beulich
Acked-by: Jan Beulich
Signed-off-by: Konrad Rzeszutek Wilk
Acked-by: Ian Campbell
This is CVE-2015-2752 / XSA-125.
Conflicts:
xen/arch/x86/domctl.c
Acked-by: Chuck Anderson
Reviewed-by: Konrad Rzeszutek Wilk [bug 20732402] {CVE-2015-2752}
Related CVEs
Updated Packages
| Release/Architecture | Filename | MD5sum | Superseded By Advisory |
|
| Oracle VM 3.2 (x86_64) | xen-4.1.3-25.el5.127.36.1.src.rpm | 00c59e376b28147e2fd189ad47a3c593 | OVMSA-2021-0014 |
| xen-4.1.3-25.el5.127.36.1.x86_64.rpm | cf8e5c6b3e35733ee1607cc585c594c0 | OVMSA-2021-0014 |
| xen-devel-4.1.3-25.el5.127.36.1.x86_64.rpm | 55c75ab23a5a64a72b832ee44700322b | OVMSA-2019-0048 |
| xen-tools-4.1.3-25.el5.127.36.1.x86_64.rpm | 4a165b0251502ea9ae5ea54990121f0d | OVMSA-2021-0014 |
This page is generated automatically and has not been checked for errors or omissions. For clarification
or corrections please contact the Oracle Linux ULN team
