Information

Files

Advisory

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

            Xen Security Advisory CVE-2017-15595 / XSA-240
                               version 6

           Unlimited recursion in linear pagetable de-typing

UPDATES IN VERSION 6
====================

Yet another new patch, addressing another issue similar to the one
addressed in v5.

ISSUE DESCRIPTION
=================

x86 PV guests are permitted to set up certain forms of what is often
called "linear page tables", where pagetables contain references to
other pagetables at the same level or higher.  Certain restrictions
apply in order to fit into Xen's page type handling system.  An
important restriction was missed, however: Stacking multiple layers
of page tables of the same level on top of one another is not very
useful, and the tearing down of such an arrangement involves
recursion.  With sufficiently many layers such recursion will result
in a stack overflow, commonly resulting in Xen to crash.

IMPACT
======

A malicious or buggy PV guest may cause the hypervisor to crash,
resulting in Denial of Service (DoS) affecting the entire host.
Privilege escalation and information leaks cannot be excluded.

VULNERABLE SYSTEMS
==================

All Xen versions from at least 3.2 onwards are vulnerable.  Earlier
versions have not been checked.

Only x86 systems are affected.  ARM systems are not affected.

Only x86 PV guests can leverage the vulnerability.  x86 HVM guests
cannot leverage the vulnerability.

MITIGATION
==========

Running only HVM guests will avoid this vulnerability.

For PV guests, the vulnerability can be avoided if the guest kernel is
controlled by the host rather than guest administrator, provided that
further steps are taken to prevent the guest administrator from loading
code into the kernel (e.g. by disabling loadable modules etc) or from
using other mechanisms which allow them to run code at kernel privilege.

CREDITS
=======

This issue was discovered by Jann Horn of Google Project Zero.

RESOLUTION
==========

Applying the appropriate attached patch series resolves this issue.
The first patch fixes this known issue.  The second, optional, patch
in each series disables the `linear pagetable` option by default.  It
can be re-enabled by adding "pv-linear-pt=true' on the Xen
command-line.

Note that neither Linux nor MiniOS use linear pagetables; NetBSD and
Novell Netware, however, do use this feature when running in PV mode.

xsa240-unstable/*.patch  xen-unstable
xsa240-4.9/*.patch       Xen 4.9.x
xsa240-4.8/*.patch       Xen 4.8.x
xsa240-4.7/*.patch       Xen 4.7.x
xsa240-4.6/*.patch       Xen 4.6.x
xsa240-4.5/*.patch       Xen 4.5.x

$ sha256sum xsa240* xsa240*/*
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855  xsa240.meta
e227126ea204d6049c8bfb694e3d2bcac10382733ca4ece1f0f7dc36c625ac1d  xsa240-unstable/0001-x86-limit-linear-page-table-use-to-a-single-level.patch
c6bb1f47754bf4f57bb9205509c525336ff55da8bcae8ae95415bdf1bba70209  xsa240-unstable/0002-x86-mm-Disable-PV-linear-pagetables-by-default.patch
549f56c7a3eacd1fc308a46ac5db32f2191d67e7e25aff501fb2ba26cc979feb  xsa240-unstable/0003-x86-dont-wrongly-trigger-linear-page-table-assertion.patch
d157826cbbae2f8815ccfb3aa23b936c5f7e7f5fb802cb85ae9e873723ac3d79  xsa240-unstable/0004-x86-dont-wrongly-trigger-linear-page-table-assertion-2.patch
2e8168449f8594c5faa50feb311eaa7e74b38c726853b1cfbaf2fbd4cbbdb476  xsa240-4.5/0001-x86-limit-linear-page-table-use-to-a-single-level.patch
ea95ed56a5f85753a41ca1abbb4abd5ea791d7596c8a9d20ceaa53862ee5ce15  xsa240-4.5/0002-x86-mm-Disable-PV-linear-pagetables-by-default.patch
76ba9206fbab686cc8c3b8b21945532b7029cc4725ee1cc38666035152ba87ad  xsa240-4.5/0003-x86-dont-wrongly-trigger-linear-page-table-assertion.patch
c0851264065f22ea60d54df7a23cda68b24762c032d881bd3d77c5f5f7f65dad  xsa240-4.5/0004-x86-dont-wrongly-trigger-linear-page-table-assertion-2.patch
f7556cc4a13cd4334d79e73861f15dd619dfd6041a3ad89865b358035d2fcff8  xsa240-4.6/0001-x86-limit-linear-page-table-use-to-a-single-level.patch
24ad9f92938c112a6fcf46177d44597c49dc213a3644ce4fd59d4df507b072d3  xsa240-4.6/0002-x86-mm-Disable-PV-linear-pagetables-by-default.patch
2fe49415a8925dda416fd2594f935ec03c8070bea4a049c1ad242c646fef01e1  xsa240-4.6/0003-x86-dont-wrongly-trigger-linear-page-table-assertion.patch
0c78bddbf12cefe9e04001ca31c5b913b3914eb80b63b27d1918a10a24022e74  xsa240-4.6/0004-x86-dont-wrongly-trigger-linear-page-table-assertion-2.patch
5a9b8e0a4e55482826e6cf820ea01fbf6674fecf19b101f4578396e3fa98a8fd  xsa240-4.7/0001-x86-limit-linear-page-table-use-to-a-single-level.patch
acf9744b853c1c6ac071bcf5776d8d9463781bbdf658c2fecc59ee338c094750  xsa240-4.7/0002-x86-mm-Disable-PV-linear-pagetables-by-default.patch
637ef53ca2d6633104abff47be208d87836042af79082666cb818f0ad53b6452  xsa240-4.7/0003-x86-dont-wrongly-trigger-linear-page-table-assertion.patch
7acccf8867d779914e77a83efcb0dbd172e572de8f700b9ac18db1194c37f82f  xsa240-4.7/0004-x86-dont-wrongly-trigger-linear-page-table-assertion-2.patch
c0c624f51fb1bd9e31a2c120343164d545ab6e709ed4bb9e5dd89b5c4c4e49f8  xsa240-4.8/0001-x86-limit-linear-page-table-use-to-a-single-level.patch
7e3c2c4a4d0ee0a29abaa7aceffbb774b1f92aa81dfa4c5d1c5c5156b6bb0a3a  xsa240-4.8/0002-x86-mm-Disable-PV-linear-pagetables-by-default.patch
f174ee608a7f7f0601ae46edafbf443c90a87632609c1b4145fb0e2e5c4b1b51  xsa240-4.8/0003-x86-dont-wrongly-trigger-linear-page-table-assertion.patch
eb74c580bdf0f972833ef058e7db50fe5f524d38d886776c66942712597a52c4  xsa240-4.8/0004-x86-dont-wrongly-trigger-linear-page-table-assertion-2.patch
7769866805e47b7a2109ba1778f263ddfa126bcb0b116612f76dfaca9bf70995  xsa240-4.9/0001-x86-limit-linear-page-table-use-to-a-single-level.patch
1053cb348dc8536cb12b4aca556ddc4c015810f8f0fd21a80dff37433ec082ea  xsa240-4.9/0002-x86-mm-Disable-PV-linear-pagetables-by-default.patch
4b312010962a294660b2e78a9a5bfd9d537000ceda11e587f88fc49da560c0ff  xsa240-4.9/0003-x86-dont-wrongly-trigger-linear-page-table-assertion.patch
9b79fb9b176e34b6f1c1208713537130c7ffe7e73e7b9a80e95b53209587628a  xsa240-4.9/0004-x86-dont-wrongly-trigger-linear-page-table-assertion-2.patch
$

DEPLOYMENT DURING EMBARGO
=========================

Deployment of the patches and/or mitigations described above (or
others which are substantially similar) is permitted during the
embargo, even on public-facing systems with untrusted guest users and
administrators.

But: Distribution of updated software is prohibited (except to other
members of the predisclosure list).

Predisclosure list members who wish to deploy significantly different
patches and/or mitigations, please contact the Xen Project Security
Team.

(Note: this during-embargo deployment notice is retained in
post-embargo publicly released Xen Project advisories, even though it
is then no longer applicable.  This is to enable the community to have
oversight of the Xen Project Security Team's decisionmaking.)

For more information about permissible uses of embargoed information,
consult the Xen Project community's agreed Security Policy:
  http://www.xenproject.org/security-policy.html
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQEcBAEBCAAGBQJaLstaAAoJEIP+FMlX6CvZxdMIAIzMc0f+pU0bvefVCMuE7LBN
Xx3bSZ1Yd1V1c9/RmQMsxgv6BQ0hgoiAs9tP0PQ89UJ7CfJfWb221DMXuThhKSmo
1zxH4D0gyUzM01JxaCGjFAUAd30Aa9tZE9M5rgTVSyt3QiLL7IcjY6fks3+HBjMq
2phYB5p7vP9HRZbDbEnAEZRtUzMUUo8QlnjGYvc14wkr/e6quGNsWMKje82y42ha
5mNQ+4XfFI+PPBjAGV12aEHmwmx9PDPnrY59y2rkFoxGIZDjIRLjKS97ULlqq4WU
UbpNgAgrIr2ntfLKQvXKp0oGv+IvxBAMLGzxLWZ0VwKjp6tSUjohnVjq0Twb/74=
=luoB
-----END PGP SIGNATURE-----