OVMSA-2017-0177 - xen security update
| Type: | SECURITY |
| Severity: | IMPORTANT |
| Release Date: | 2017-12-13 |
Description
[4.3.0-55.el6.186.63]
- Due to the history performance reason, we decide to disable PoD feature
in old OVM product.XSA-246,XSA-247 [bug 27121016] {CVE-2017-17044,CVE-2017-17045}
[4.3.0-55.el6.186.62]
- From 2a99aa99fc84a45f505f84802af56b006d14c52e Mon Sep 17 00:00:00 2001
From: Andrew Cooper
Date: Fri, 19 Aug 2016 15:08:10 +0100
Subject: [PATCH] xen/physmap: Do not permit a guest to populate PoD pages for itself
PoD is supposed to be entirely transparent to guest, but this interface has
been left exposed for a long time.
The use of PoD requires careful co-ordination by the toolstack with the
XENMEM_{get,set}_pod_target hypercalls, and xenstore ballooning target. The
best a guest can do without toolstack cooperation crash.
Furthermore, there are combinations of features (e.g. c/s c63868ff 'libxl:
disallow PCI device assignment for HVM guest when PoD is enabled') which a
toolstack might wish to explicitly prohibit (in this case, because the two
simply don't function in combination). In such cases, the guest mustn't be
able to subvert the configuration chosen by the toolstack.
Signed-off-by: Andrew Cooper
Acked-by: Jan Beulich
Conflict:
xen/common/memory.c
Signed-off-by: Zhenzhong Duan [bug 27121016]
[4.3.0-55.el6.186.61]
- x86/shadow: correct SH_LINEAR mapping detection in sh_guess_wrmap()
The fix for XSA-243 / CVE-2017-15592 (c/s bf2b4eadcf379) introduced a change
in behaviour for sh_guest_wrmap(), where it had to cope with no shadow linear
mapping being present.
As the name suggests, guest_vtable is a mapping of the guests pagetable, not
Xen's pagetable, meaning that it isn't the pagetable we need to check for the
shadow linear slot in.
The practical upshot is that a shadow HVM vcpu which switches into 4-level
paging mode, with an L4 pagetable that contains a mapping which aliases Xen's
SH_LINEAR_PT_VIRT_START will fool the safety check for whether a SHADOW_LINEAR
mapping is present. As the check passes (when it should have failed), Xen
subsequently falls over the missing mapping with a pagefault such as:
(XEN) Pagetable walk from ffff8140a0503880:
(XEN) L4[0x102] = 000000046c218063 ffffffffffffffff
(XEN) L3[0x102] = 000000046c218063 ffffffffffffffff
(XEN) L2[0x102] = 000000046c218063 ffffffffffffffff
(XEN) L1[0x103] = 0000000000000000 ffffffffffffffff
This is part of XSA-243.
Signed-off-by: Andrew Cooper
Reviewed-by: Tim Deegan
Backported-by: Zhenzhong Duan [bug 26896489] {CVE-2017-15592}
Related CVEs
Updated Packages
| Release/Architecture | Filename | MD5sum | Superseded By Advisory |
|
| Oracle VM 3.3 (x86_64) | xen-4.3.0-55.el6.186.63.src.rpm | 2837b37d0759d909d4e3eab544dffa11 | OVMSA-2021-0014 |
| xen-4.3.0-55.el6.186.63.x86_64.rpm | 14ab585fd62bc2f1572d9f187824cdb5 | OVMSA-2021-0014 |
| xen-tools-4.3.0-55.el6.186.63.x86_64.rpm | 7e7c0b022a2f1df3f34ff2ed183ae3c1 | OVMSA-2021-0014 |
This page is generated automatically and has not been checked for errors or omissions. For clarification
or corrections please contact the Oracle Linux ULN team
