OVMSA-2017-0178 - xen security update
| Type: | SECURITY |
| Severity: | IMPORTANT |
| Release Date: | 2017-12-13 |
Description
[4.1.3-25.el5.223.99]
- From 2a99aa99fc84a45f505f84802af56b006d14c52e Mon Sep 17 00:00:00 2001
From: Andrew Cooper
Date: Fri, 19 Aug 2016 15:08:10 +0100
Subject: [PATCH] xen/physmap: Do not permit a guest to populate PoD pages for itself
PoD is supposed to be entirely transparent to guest, but this interface has
been left exposed for a long time.
The use of PoD requires careful co-ordination by the toolstack with the
XENMEM_{get,set}_pod_target hypercalls, and xenstore ballooning target. The
best a guest can do without toolstack cooperation crash.
Furthermore, there are combinations of features (e.g. c/s c63868ff 'libxl:
disallow PCI device assignment for HVM guest when PoD is enabled') which a
toolstack might wish to explicitly prohibit (in this case, because the two
simply don't function in combination). In such cases, the guest mustn't be
able to subvert the configuration chosen by the toolstack.
Signed-off-by: Andrew Cooper
Acked-by: Jan Beulich
Conflict:
xen/common/memory.c
Signed-off-by: Zhenzhong Duan [bug 27120669]
- Due to the history performance reason, we decide to disable PoD feature
in old OVM product. Please don't set maxmem>memory
XSA-246,XSA-247 [bug 27120669] {CVE-2017-17044,CVE-2017-17045}
[4.1.3-25.el5.223.98]
- x86/shadow: correct SH_LINEAR mapping detection in sh_guess_wrmap()
The fix for XSA-243 / CVE-2017-15592 (c/s bf2b4eadcf379) introduced a change
in behaviour for sh_guest_wrmap(), where it had to cope with no shadow linear
mapping being present.
As the name suggests, guest_vtable is a mapping of the guests pagetable, not
Xen's pagetable, meaning that it isn't the pagetable we need to check for the
shadow linear slot in.
The practical upshot is that a shadow HVM vcpu which switches into 4-level
paging mode, with an L4 pagetable that contains a mapping which aliases Xen's
SH_LINEAR_PT_VIRT_START will fool the safety check for whether a SHADOW_LINEAR
mapping is present. As the check passes (when it should have failed), Xen
subsequently falls over the missing mapping with a pagefault such as:
(XEN) Pagetable walk from ffff8140a0503880:
(XEN) L4[0x102] = 000000046c218063 ffffffffffffffff
(XEN) L3[0x102] = 000000046c218063 ffffffffffffffff
(XEN) L2[0x102] = 000000046c218063 ffffffffffffffff
(XEN) L1[0x103] = 0000000000000000 ffffffffffffffff
This is part of XSA-243.
Signed-off-by: Andrew Cooper
Reviewed-by: Tim Deegan
Backported-by: Zhenzhong Duan [bug 26976552] {CVE-2017-15592}
[4.1.3-25.el5.223.97]
- dpci: Fix a race during unbinding of MSI interrupt
The check of hvm_irq_dpci->mapping and read of flags are not protected in same
critical area, so the unbind of MSI interrupt may intercepts between them.
Like below scene:
CPU0 CPU1
---- ----
hvm_do_IRQ_dpci()
!test_bit(mirq, dpci->mapping))
return 0;
spin_lock(&d->event_lock);
hvm_irq_dpci->mirq[machine_gsi].flags = 0;
clear_bit(machine_gsi, hvm_irq_dpci->mapping);
spin_unlock(&d->event_lock);
hvm_dirq_assist()
spin_lock(&d->event_lock);
if ( pt_irq_need_timer(hvm_irq_dpci->mirq[pirq].flags) )
set_timer();
spin_unlock(&d->event_lock);
Then set_timer() is mistakenly called which access uninitialized timer struct.
Then page fault happen and a backtrace like below:
(XEN) Xen call trace:
(XEN) [] set_timer+0x92/0x170
(XEN) [] hvm_dirq_assist+0x1c3/0x1e0
(XEN) [] do_tasklet_work_percpu+0x7f/0x120
(XEN) [] __do_softirq+0x65/0x90
(XEN) [] process_softirqs+0x6/0x10
(XEN)
(XEN) Pagetable walk from 0000000000000008:
(XEN) L4[0x000] = 0000002104cc1067 0000000000289430
(XEN) L3[0x000] = 000000212ecd8067 00000000002b3447
(XEN) L2[0x000] = 0000000000000000 ffffffffffffffff
(XEN)
(XEN) ****************************************
(XEN) Panic on CPU 41:
(XEN) FATAL PAGE FAULT
(XEN) [error_code=0002]
(XEN) Faulting linear address: 0000000000000008
(XEN) ****************************************
This issue is OVM3.2 only as OVM3.3 or above already has similar fix in
pt_pirq_iterate()
Signed-off-by: Zhenzhong Duan
Reviewed-by: Joe Jin
Reviewed-by: Konrad Rzeszutek Wilk [bug 26896681]
Related CVEs
Updated Packages
| Release/Architecture | Filename | MD5sum | Superseded By Advisory |
|
| Oracle VM 3.2 (x86_64) | xen-4.1.3-25.el5.223.99.src.rpm | 1fb18ac30ec2c581c79dd7457cca681b | OVMSA-2021-0014 |
| xen-4.1.3-25.el5.223.99.x86_64.rpm | 10f67b239ba63ec4c2b7428245fe43a7 | OVMSA-2021-0014 |
| xen-devel-4.1.3-25.el5.223.99.x86_64.rpm | a45a8c573fa2ea9eac823b8c0212feba | OVMSA-2019-0048 |
| xen-tools-4.1.3-25.el5.223.99.x86_64.rpm | 3e39b7a8591e68dd956ca5a03f6f6d97 | OVMSA-2021-0014 |
This page is generated automatically and has not been checked for errors or omissions. For clarification
or corrections please contact the Oracle Linux ULN team
