[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <20081004160557.GA7301@redhat.com>
Date: Sat, 4 Oct 2008 17:05:57 +0100
From: "Daniel P. Berrange" <berrange@...hat.com>
To: "Steven M. Christey" <coley@...us.mitre.org>
Cc: oss-security@...ts.openwall.com, coley@...re.org
Subject: Re: CVE Request (xen)
On Fri, Oct 03, 2008 at 05:17:44PM -0400, Steven M. Christey wrote:
>
> We wrote this up as a libvirt issue, but is it really a Xen issue?
At its core it is a Xen permissions issue, because the host was not
protecting data it mainers from guest modification. This permissions
problem impacted Xen tools themselves, and any other application
which made use of xenstore - of which libvirt was one. The original
proposed fix to Xen would require changes in both Xen and libvirt
to fully resolve. The Xen developers eventually worked out a fix
that directly addresses all users, so there is no longer any need
for libvirt to be fixed. It is sufficient to apply the Xen permisions
fixes, so I'd class this as primarily a Xen issue.
Regards,
Daniel
--
|: Red Hat, Engineering, London -o- http://people.redhat.com/berrange/ :|
|: http://libvirt.org -o- http://virt-manager.org -o- http://ovirt.org :|
|: http://autobuild.org -o- http://search.cpan.org/~danberr/ :|
|: GnuPG: 7D3B9505 -o- F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 :|
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
