-----BEGIN PGP SIGNED MESSAGE-----
Xen Security Advisory CVE-2020-11740,CVE-2020-11741 / XSA-313
multiple xenoprof issues
UPDATES IN VERSION 3
Unprivileged guests can request to map xenoprof buffers, even if
profiling has not been enabled for those guests. These buffers were
not scrubbed. This is CVE-2020-11740.
Furthermore, for guests for which "active" profiling was enabled by
the administrator, the xenoprof code uses the standard Xen shared ring
structure. Unfortunately, this code did not treat the guest as a
potential adversary: it trusts the guest not to modify buffer size
information or modify head / tail pointers in unexpected ways. This is
A malicious guest may be able to access sensitive information
pertaining to other guests. Guests with "active profiling" enabled
can crash the host (DoS). Privilege escalation cannot be ruled out.
Only x86 PV guests can leverage the vulnerabilities. Arm guests and
x86 HVM and PVH guests cannot leverage the vulnerabilities.
All Xen versions back to at least 3.2 are vulnerable.
Any x86 PV guest can leverage the information leak. Only x86 PV guests
whose host administrator has explicitly enabled "active profiling" for an
untrusted guest can exploit the DoS / potential privilege escalation.
Only builds of Xen with the Xenoprof functionality enabled at build
time are vulnerable. The option to disable the functionality at build
time was been introduced in Xen 4.7.
Never making any untrusted guests "active" will avoid all but the info
leak part of the vulnerabilities. There's no known mitigation for the
information leak (lack of scrubbing).
This issue was discovered by Ilja Van Sprundel of IOActive.
Applying the attached set of patches resolves these issues.
The first patch fixes the information leak issue, and should be
applied to all x86 systems running untrusted PV guests.
The second patch fixes the "active profiling" issue. Systems which do
not enable active profiling can safely skip patch 2.
Note that patches for released versions are generally prepared to
apply to the stable branches, and may not apply cleanly to the most
recent release tarball. Downstreams are encouraged to update to the
tip of the stable branch before applying these patches.
xsa313-?.patch xen-unstable, Xen 4.9.x - 4.13.x
$ sha256sum xsa313*
DEPLOYMENT DURING EMBARGO
Deployment of the patches and/or mitigations described above (or
others which are substantially similar) is permitted during the
embargo, even on public-facing systems with untrusted guest users and
But: Distribution of updated software is prohibited (except to other
members of the predisclosure list).
Predisclosure list members who wish to deploy significantly different
patches and/or mitigations, please contact the Xen Project Security
(Note: this during-embargo deployment notice is retained in
post-embargo publicly released Xen Project advisories, even though it
is then no longer applicable. This is to enable the community to have
oversight of the Xen Project Security Team's decisionmaking.)
For more information about permissible uses of embargoed information,
consult the Xen Project community's agreed Security Policy:
-----BEGIN PGP SIGNATURE-----
-----END PGP SIGNATURE-----
|Free forum by Nabble||Edit this page|