Bugzilla – Bug 860300
VUL-1: CVE-2014-1896: xen: XSA-86: libvchan failure handling malicious ring indexes
Last modified: 2015-02-19 03:34:08 UTC
bugbot adjusting priority
Public now: Xen Security Advisory XSA-86 version 2 libvchan failure handling malicious ring indexes UPDATES IN VERSION 2 ==================== Public release. ISSUE DESCRIPTION ================= libvchan (a library for inter-domain communication) does not correctly handle unusual or malicious contents in the xenstore ring. A malicious guest can exploit this to cause a libvchan-using facility to read or write past the end of the ring. IMPACT ====== libvchan-using facilities are vulnerable to denial of service and perhaps privilege escalation. There are no such services provided in the upstream Xen Project codebase. VULNERABLE SYSTEMS ================== All versions of libvchan are vulnerable. Only installations which use libvchan for communication involving untrusted domains are vulnerable. libvirt, xapi, xend, libxl and xl do not use libvchan. If your installation contains other Xen-related software components it is possible that they use libvchan and might be vulnerable. Xen versions 4.1 and earlier do not contain libvchan. MITIGATION ========== Disabling libvchan-based facilities could be used to mitigate the vulnerability. CREDITS ======= This issue was discovered by Marek Marczykowski-Górecki of Invisible Things Lab. RESOLUTION ========== Applying the appropriate attached patch resolves this issue. After the patch is applied to the Xen tree and built, any software which is statically linked against libvchan will need to be relinked against the new libvchan.a for the fix to take effect. xsa86.patch Xen 4.2.x, 4.3.x, 4.4-RC series, and xen-unstable $ sha256sum xsa86*.patch cd2df017e42717dd2a1b6f2fdd3ad30a38d3c0fbdd9d08b5f56ee0a01cd87b51 xsa86.patch $
CVE-2014-1896 was assigned to this issue.
"All versions of libvchan are vulnerable.... Xen versions 4.1 and earlier do not contain libvchan." This effects SLE11-SP3, openSUSE:12.3 and openSUSE:13.1 if libvchan is used.
Xen package submitted for this bug with the following requests: SUSE:SLE-11-SP3:Update:Test: SR#33408 openSUSE:13.1:Update: MR#223835 openSUSE:12.3:Update: MR#223847
Update released for: xen, xen-debuginfo, xen-debugsource, xen-devel, xen-doc-html, xen-doc-pdf, xen-kmp-debug, xen-kmp-default, xen-kmp-pae, xen-kmp-trace, xen-kmp-vmi, xen-libs, xen-libs-32bit, xen-libs-x86, xen-tools, xen-tools-domU Products: SLE-DEBUGINFO 11-SP3 (i386, x86_64) SLE-DESKTOP 11-SP3 (i386, x86_64) SLE-SDK 11-SP3 (i386, x86_64) SLE-SERVER 11-SP3 (i386, x86_64)
SUSE-SU-2014:0373-1: An update that solves 12 vulnerabilities and has one errata is now available. Category: security (important) Bug References: 831120,833251,848014,853048,853049,858311,860092,860163,860165,860300,860302,861256,863297 CVE References: CVE-2013-2212,CVE-2013-6400,CVE-2013-6885,CVE-2014-1642,CVE-2014-1666,CVE-2014-1891,CVE-2014-1892,CVE-2014-1893,CVE-2014-1894,CVE-2014-1895,CVE-2014-1896,CVE-2014-1950 Sources used: SUSE Linux Enterprise Software Development Kit 11 SP3 (src): xen-4.2.4_02-0.7.1 SUSE Linux Enterprise Server 11 SP3 (src): xen-4.2.4_02-0.7.1 SUSE Linux Enterprise Desktop 11 SP3 (src): xen-4.2.4_02-0.7.1
Fixed and released. Closing Bug.
openSUSE-SU-2014:0483-1: An update that solves 16 vulnerabilities and has 5 fixes is now available. Category: security (moderate) Bug References: 831120,833251,833483,840997,842417,846849,848014,848657,849665,849667,849668,853048,853049,858311,858496,860163,860165,860300,860302,861256,863297 CVE References: CVE-2013-2212,CVE-2013-4494,CVE-2013-4551,CVE-2013-4553,CVE-2013-4554,CVE-2013-6400,CVE-2013-6885,CVE-2014-1642,CVE-2014-1666,CVE-2014-1891,CVE-2014-1892,CVE-2014-1893,CVE-2014-1894,CVE-2014-1895,CVE-2014-1896,CVE-2014-1950 Sources used: openSUSE 12.3 (src): xen-4.2.4_02-1.26.2