Bug 849665 (CVE-2013-4551) - VUL-0: CVE-2013-4551: xen: XSA-75: Host crash due to guest VMX instruction execution
Summary: VUL-0: CVE-2013-4551: xen: XSA-75: Host crash due to guest VMX instruction ex...
Status: RESOLVED FIXED
Alias: CVE-2013-4551
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P2 - High : Major
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL:
Whiteboard: maint:running:55163:moderate maint:re...
Keywords:
Depends on:
Blocks:
 
Reported: 2013-11-08 20:13 UTC by Marcus Meissner
Modified: 2015-02-18 22:33 UTC (History)
4 users (show)

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments
xsa75-4.2.patch (1.55 KB, patch)
2013-11-08 20:23 UTC, Marcus Meissner
Details | Diff
xsa75-4.3-unstable.patch (1.71 KB, patch)
2013-11-08 20:24 UTC, Marcus Meissner
Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Marcus Meissner 2013-11-08 20:13:51 UTC
public via oss-sec

CVE-2013-4551

                  Xen Security Advisory XSA-75

           Host crash due to guest VMX instruction execution

ISSUE DESCRIPTION
=================

Permission checks on the emulation paths (intended for guests using
nested virtualization) for VMLAUNCH and VMRESUME were deferred too
much.  The hypervisor would try to use internal state which is not set
up unless nested virtualization is actually enabled for a guest.

IMPACT
======

A malicious or misbehaved HVM guest, including malicious or misbehaved user
mode code run in the guest, might be able to crash the host.

VULNERABLE SYSTEMS
==================

Xen 4.2.x and later are vulnerable.
Xen 4.1.x and earlier are not vulnerable.

Only HVM guests run on VMX capable (e.g. Intel) hardware can take
advantage of this vulnerability.

MITIGATION
==========
Running only PV guests, or running HVM guests on SVM capable
(e.g. AMD) hardware will avoid this issue.

Enabling nested virtualization for a HVM guest running on VMX capable
hardware would also allow avoiding the issue.  However this
functionality is still considered experimental, and is not covered by
security support from the Xen Project security team.  This approach is
therefore not recommended for use in production.

CREDITS
=======

This issue was discovered by Jeff Zimmerman.

NOTE REGARDING LACK OF EMBARGO
==============================

This issue was disclosed publicly on the xen-devel mailing list.

RESOLUTION
==========

Applying the appropriate attached patch resolves this issue.

xsa75-4.3-unstable.patch    Xen 4.3.x, xen-unstable
xsa75-4.2.patch             Xen 4.2.x

$ sha256sum xsa75*.patch
0b2da4ede6507713c75e313ba468b1fd7110e5696974ab72e2135f41ee393a8b  xsa75-4.2.patch
91936421279fd2fa5321d9ed5a2b71fe76bc0e1348e67126e8b9cde0cb1d32b2  xsa75-4.3-unstable.patch
$
Comment 1 Marcus Meissner 2013-11-08 20:23:43 UTC
Created attachment 566739 [details]
xsa75-4.2.patch

xsa75-4.2.patch
Comment 2 Marcus Meissner 2013-11-08 20:24:05 UTC
Created attachment 566740 [details]
xsa75-4.3-unstable.patch

xsa75-4.3-unstable.patch
Comment 3 Swamp Workflow Management 2013-11-08 23:00:27 UTC
bugbot adjusting priority
Comment 4 Jan Beulich 2013-11-11 08:49:54 UTC
"P3 - Medium" for an issue where guest _user mode_ can crash the host?
Comment 5 Charles Arnold 2013-11-18 18:40:38 UTC
This was submitted for swamp 54914.

SLE11-SP3 SR#: 29400
SLE11-SP2 SR#: 29401
Comment 6 Swamp Workflow Management 2013-12-16 10:04:50 UTC
openSUSE-SU-2013:1876-1: An update that solves 5 vulnerabilities and has two fixes is now available.

Category: security (moderate)
Bug References: 845520,848657,849665,849667,849668,851386,851749
CVE References: CVE-2013-4416,CVE-2013-4494,CVE-2013-4551,CVE-2013-4553,CVE-2013-4554
Sources used:
openSUSE 13.1 (src):    xen-4.3.1_02-4.4
Comment 7 Marcus Meissner 2013-12-19 15:43:22 UTC
done
Comment 8 Swamp Workflow Management 2013-12-19 17:49:06 UTC
Update released for: xen, xen-debuginfo, xen-debugsource, xen-devel, xen-doc-html, xen-doc-pdf, xen-kmp-debug, xen-kmp-default, xen-kmp-pae, xen-kmp-trace, xen-kmp-vmi, xen-libs, xen-libs-32bit, xen-tools, xen-tools-domU
Products:
SLE-DEBUGINFO 11-SP3 (i386, x86_64)
SLE-DESKTOP 11-SP3 (i386, x86_64)
SLE-SDK 11-SP3 (i386, x86_64)
SLE-SERVER 11-SP3 (i386, x86_64)
Comment 9 Swamp Workflow Management 2013-12-19 21:05:49 UTC
SUSE-SU-2013:1923-1: An update that solves 8 vulnerabilities and has two fixes is now available.

Category: security (moderate)
Bug References: 833483,840997,842417,846849,848014,848657,849665,849667,849668,851386
CVE References: CVE-2013-1922,CVE-2013-2007,CVE-2013-4375,CVE-2013-4416,CVE-2013-4494,CVE-2013-4551,CVE-2013-4553,CVE-2013-4554
Sources used:
SUSE Linux Enterprise Software Development Kit 11 SP3 (src):    xen-4.2.3_08-0.7.1
SUSE Linux Enterprise Server 11 SP3 (src):    xen-4.2.3_08-0.7.1
SUSE Linux Enterprise Desktop 11 SP3 (src):    xen-4.2.3_08-0.7.1
Comment 10 Swamp Workflow Management 2014-04-04 14:08:24 UTC
openSUSE-SU-2014:0483-1: An update that solves 16 vulnerabilities and has 5 fixes is now available.

Category: security (moderate)
Bug References: 831120,833251,833483,840997,842417,846849,848014,848657,849665,849667,849668,853048,853049,858311,858496,860163,860165,860300,860302,861256,863297
CVE References: CVE-2013-2212,CVE-2013-4494,CVE-2013-4551,CVE-2013-4553,CVE-2013-4554,CVE-2013-6400,CVE-2013-6885,CVE-2014-1642,CVE-2014-1666,CVE-2014-1891,CVE-2014-1892,CVE-2014-1893,CVE-2014-1894,CVE-2014-1895,CVE-2014-1896,CVE-2014-1950
Sources used:
openSUSE 12.3 (src):    xen-4.2.4_02-1.26.2