Information

Files

Advisory

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

            Xen Security Advisory CVE-2014-8867 / XSA-112
                              version 6

  Insufficient bounding of "REP MOVS" to MMIO emulated inside the hypervisor

UPDATES IN VERSION 6
====================

Fix patch name.

ISSUE DESCRIPTION
=================

Acceleration support for the "REP MOVS" instruction, when the first
iteration accesses memory mapped I/O emulated internally in the
hypervisor, incorrectly assumes that the whole range accessed is
handled by the same hypervisor sub-component.

IMPACT
======

A buggy or malicious HVM guest can crash the host.

VULNERABLE SYSTEMS
==================

Xen versions from at least 3.2.x onwards are vulnerable on x86 systems.
Older versions have not been inspected.  ARM systems are not vulnerable.

MITIGATION
==========

Running only PV guests will avoid this issue.

There is no mitigation available for HVM guests.

CREDITS
=======

This issue was discovered by Jan Beulich of SUSE.

RESOLUTION
==========

Applying the appropriate attached patch resolves this issue.

xsa112.patch                 xen-unstable, Xen 4.4.x, Xen 4.3.x
xsa112-4.2.patch             Xen 4.2.x

$ sha256sum xsa112*.patch
cf01a1acd258e7cbb3586e543ba3668c1ee7fb05cba19b8b5369a3e101a2288f  xsa112-4.2.patch
cc39a4cdcb52929ed36ab696807d2405aa552177a6f029d8a1a52041ca1ed519  xsa112.patch
$

We have been told that this patch is not sufficient on Xen 3.3.x and
earlier without also backporting b1b6362f (git commit id).

Note that while we are happy to share information we receive about
earlier Xen versions, the earliest Xen branch for which the Xen
Project offers security support is 4.2.x.
-----BEGIN PGP SIGNATURE-----

iQFABAEBCAAqFiEEI+MiLBRfRHX6gGCng/4UyVfoK9kFAmV8b+sMHHBncEB4ZW4u
b3JnAAoJEIP+FMlX6CvZDz0H/19+Y/hxiUWxlSpatcNizXhCSTCUoLSlu+q8zIn1
8JcISVaxCgtq0jNg4/1XhX2YMMMGHw8CqXfwCGQIMYdAXkBDRske4b99tVhLz7v9
K6zdNSMCBnprNs87mACAwo5pZLXRE+ZtKjiqxAhN5ikp6T8nTiG9fiVe+MBp5o1R
To5i/cuDcJGDmT5pii0+ddyzUZ2ZdIqLHj/pxYKwQR1qSUWq+PKLmC0kCR8DV5dI
M1kx2vgnJxfZuBSRNWb9ZdaIYjrEc/Pk7+RUFjI2+8VYl/JwAPIg9QxHPm2q4U1p
l4sshd3EpEN8tawb/crKdiqcFt6WUaCcHiRL9KThDIctW8E=
=swgG
-----END PGP SIGNATURE-----