Bugzilla – Bug 932996
VUL-0: CVE-2015-4164: xen: DoS through iret hypercall handler (XSA-136)
Last modified: 2016-03-07 12:43:55 UTC
bugbot adjusting priority
CVE assigned
An update workflow for this issue was started. This issue was rated as important. Please submit fixed packages until 2015-06-10. When done, reassign the bug to security-team@suse.de. https://swamp.suse.de/webswamp/wf/61875
public via http://xenbits.xen.org/xsa/advisory-136.html Xen Security Advisory CVE-2015-4164 / XSA-136 version 3 vulnerability in the iret hypercall handler UPDATES IN VERSION 3 ==================== Public release. Added email header syntax to patches, for e.g. git-am. ISSUE DESCRIPTION ================= A buggy loop in Xen's compat_iret() function iterates the wrong way around a 32-bit index. Any 32-bit PV guest kernel can trigger this vulnerability by attempting a hypercall_iret with EFLAGS.VM set. Given the use of __get/put_user(), and that the virtual addresses in question are contained within the lower canonical half, the guest cannot clobber any hypervisor data. Instead, Xen will take up to 2^33 pagefaults, in sequence, effectively hanging the host. IMPACT ====== Malicious guest administrators can cause a denial of service affecting the whole system. VULNERABLE SYSTEMS ================== Only 64-bit x86 (ARCH=x86_64) builds of Xen are vulnerable. 32-bit builds (ARCH=x86_32) (necessarily of Xen 4.2 or earlier), are not affected. Xen versions 3.1 or later are vulnerable. ARM systems are not vulnerable. Only 32-bit PV guests can exploit the vulnerability. MITIGATION ========== Systems which only need to run 32-bit guests and are running Xen 4.2 or earlier can avoid the vulnerability by using a 32-bit build of Xen instead of a 64-bit build. (The dom0 operating system would have to be 32-bit too.) If the boot process and kernel for the guest can be controlled, forcing it to use a 64-bit kernel will avoid the vulnerability. CREDITS ======= This issue was discovered by Andrew Cooper of Citrix. RESOLUTION ========== Applying the attached patch resolves this issue. $ sha256sum xsa136*.patch b54a71cf41d333345a9b8fd5f3f1aa644000a24e20343b54e5a41cd51d14af04 xsa136.patch $ DEPLOYMENT DURING EMBARGO ========================= Deployment of the patches and/or mitigations described above (or others which are substantially similar) is permitted during the embargo, even on public-facing systems with untrusted guest users and administrators. But: Distribution of updated software is prohibited (except to other members of the predisclosure list). Predisclosure list members who wish to deploy significantly different patches and/or mitigations, please contact the Xen Project Security Team. (Note: this during-embargo deployment notice is retained in post-embargo publicly released Xen Project advisories, even though it is then no longer applicable. This is to enable the community to have oversight of the Xen Project Security Team's decisionmaking.) For more information about permissible uses of embargoed information, consult the Xen Project community's agreed Security Policy: http://www.xenproject.org/security-policy.html
SUSE-SU-2015:1042-1: An update that solves 7 vulnerabilities and has one errata is now available. Category: security (important) Bug References: 906689,931625,931626,931627,931628,932770,932790,932996 CVE References: CVE-2015-3209,CVE-2015-4103,CVE-2015-4104,CVE-2015-4105,CVE-2015-4106,CVE-2015-4163,CVE-2015-4164 Sources used: SUSE Linux Enterprise Software Development Kit 12 (src): xen-4.4.2_06-21.1 SUSE Linux Enterprise Server 12 (src): xen-4.4.2_06-21.1 SUSE Linux Enterprise Desktop 12 (src): xen-4.4.2_06-21.1
SUSE-SU-2015:1045-1: An update that fixes 7 vulnerabilities is now available. Category: security (important) Bug References: 931625,931626,931627,931628,932770,932790,932996 CVE References: CVE-2015-3209,CVE-2015-4103,CVE-2015-4104,CVE-2015-4105,CVE-2015-4106,CVE-2015-4163,CVE-2015-4164 Sources used: SUSE Linux Enterprise Software Development Kit 11 SP3 (src): xen-4.2.5_08-0.9.1 SUSE Linux Enterprise Server 11 SP3 (src): xen-4.2.5_08-0.9.1 SUSE Linux Enterprise Desktop 11 SP3 (src): xen-4.2.5_08-0.9.1
openSUSE-SU-2015:1092-1: An update that solves 17 vulnerabilities and has 10 fixes is now available. Category: security (important) Bug References: 861318,882089,895528,901488,903680,906689,910254,912011,918995,918998,919098,919464,919663,921842,922705,922706,922709,923758,927967,929339,931625,931626,931627,931628,932770,932790,932996 CVE References: CVE-2014-3615,CVE-2015-2044,CVE-2015-2045,CVE-2015-2151,CVE-2015-2152,CVE-2015-2751,CVE-2015-2752,CVE-2015-2756,CVE-2015-3209,CVE-2015-3340,CVE-2015-3456,CVE-2015-4103,CVE-2015-4104,CVE-2015-4105,CVE-2015-4106,CVE-2015-4163,CVE-2015-4164 Sources used: openSUSE 13.2 (src): xen-4.4.2_06-23.1
openSUSE-SU-2015:1094-1: An update that fixes 8 vulnerabilities is now available. Category: security (important) Bug References: 922709,931625,931626,931627,931628,932770,932790,932996 CVE References: CVE-2015-2751,CVE-2015-3209,CVE-2015-4103,CVE-2015-4104,CVE-2015-4105,CVE-2015-4106,CVE-2015-4163,CVE-2015-4164 Sources used: openSUSE 13.1 (src): xen-4.3.4_05-47.1
SUSE-SU-2015:1156-1: An update that fixes 6 vulnerabilities is now available. Category: security (important) Bug References: 931625,931626,931627,931628,932770,932996 CVE References: CVE-2015-3209,CVE-2015-4103,CVE-2015-4104,CVE-2015-4105,CVE-2015-4106,CVE-2015-4164 Sources used: SUSE Linux Enterprise Server 11 SP1 LTSS (src): xen-4.0.3_21548_18-0.25.1
SUSE-SU-2015:1157-1: An update that fixes 7 vulnerabilities is now available. Category: security (important) Bug References: 931625,931626,931627,931628,932770,932996 CVE References: CVE-2015-3209,CVE-2015-4103,CVE-2015-4104,CVE-2015-4105,CVE-2015-4106,CVE-2015-4163,CVE-2015-4164 Sources used: SUSE Linux Enterprise Server 11 SP2 LTSS (src): xen-4.1.6_08-0.13.1
SUSE-SU-2015:1206-1: An update that fixes two vulnerabilities is now available. Category: security (important) Bug References: 932770,932996 CVE References: CVE-2015-3209,CVE-2015-4164 Sources used: SUSE Linux Enterprise Server 10 SP4 LTSS (src): xen-3.2.3_17040_46-0.17.1
SUSE-SU-2015:1479-1: An update that fixes 6 vulnerabilities is now available. Category: security (important) Bug References: 922709,932996,935634,938344,939709,939712 CVE References: CVE-2015-2751,CVE-2015-3259,CVE-2015-4164,CVE-2015-5154,CVE-2015-5165,CVE-2015-5166 Sources used: SUSE Linux Enterprise Software Development Kit 11-SP3 (src): xen-4.2.5_12-15.1 SUSE Linux Enterprise Server 11-SP3 (src): xen-4.2.5_12-15.1 SUSE Linux Enterprise Desktop 11-SP3 (src): xen-4.2.5_12-15.1 SUSE Linux Enterprise Debuginfo 11-SP3 (src): xen-4.2.5_12-15.1
SUSE-SU-2015:1479-2: An update that fixes 6 vulnerabilities is now available. Category: security (important) Bug References: 922709,932996,935634,938344,939709,939712 CVE References: CVE-2015-2751,CVE-2015-3259,CVE-2015-4164,CVE-2015-5154,CVE-2015-5165,CVE-2015-5166 Sources used: SUSE Linux Enterprise Desktop 11-SP3 (src): xen-4.2.5_12-15.1
SUSE-SU-2015:1643-1: An update that fixes four vulnerabilities is now available. Category: security (important) Bug References: 932770,932996,938344,939712 CVE References: CVE-2015-3209,CVE-2015-4164,CVE-2015-5154,CVE-2015-5165 Sources used: SUSE Linux Enterprise Server 10 SP4 LTSS (src): xen-3.2.3_17040_46-0.21.1
An update workflow for this issue was started. This issue was rated as moderate. Please submit fixed packages until 2015-11-25. When done, reassign the bug to security-team@suse.de. https://swamp.suse.de/webswamp/wf/62332
rekleased
An update workflow for this issue was started. This issue was rated as important. Please submit fixed packages until 2016-01-26. When done, reassign the bug to security-team@suse.de. https://swamp.suse.de/webswamp/wf/62448