[<prev] [next>] [day] [month] [year] [list]
Message-Id: <E1UXtyG-0007Vx-GZ@xenbits.xen.org>
Date: Thu, 02 May 2013 13:54:52 +0000
From: Xen.org security team <security@....org>
To: xen-announce@...ts.xen.org, xen-devel@...ts.xen.org,
xen-users@...ts.xen.org, oss-security@...ts.openwall.com
CC: Xen.org security team <security@....org>
Subject: Xen Security Advisory 45 (CVE-2013-1918) - Several long latency
operations are not preemptible
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Xen Security Advisory CVE-2013-1918 / XSA-45
version 2
Several long latency operations are not preemptible
UPDATES IN VERSION 2
====================
Patches for xen-unstable refreshed to apply on top of xen.git#staging
commit 9626d1c1.
Public release.
ISSUE DESCRIPTION
=================
Page table manipulation operations for PV guests can take significant
amounts of time, as they require all present branches to have their
type (and thus contents) verified. While the most frequently used
operations had been made preemptible in the past, some code paths
involving potentially deep page table traversal were still trying to
do their entire work in a single step.
IMPACT
======
Malicious or buggy PV guest kernels can mount a denial of service attack
affecting the whole system.
VULNERABLE SYSTEMS
==================
All Xen versions are vulnerable.
The vulnerability is only exposed by PV guests.
MITIGATION
==========
Running only HVM guests, or PV guests with trusted kernels, will avoid
this vulnerability.
RESOLUTION
==========
Applying the appropriate attached patch series resolves this issue.
xsa45-4.1-*.patch Xen 4.1.x
xsa45-4.2-*.patch Xen 4.2.x
xsa45-unstable-*.patch xen-unstable
$ sha256sum xsa45*.patch
9a77ffcf6af68bb578ce99aa86778767b9df89409b4ce398d9cf6ae603b60f99 xsa45-4.1-01-vcpu-destroy-pagetables-preemptible.patch
ad534cd15f83c81bc37d15f08f85cb902796494f788dc9d424ade75bd6f62114 xsa45-4.1-02-new-guest-cr3-preemptible.patch
13626e949abf555971e6696c6ddaccbab33a479e88b6ed6206e9f90a4b720090 xsa45-4.1-03-new-user-base-preemptible.patch
52ee804acae32c7b8233a0fae19ac563ae9f89ba0fd83451fe907d907f8f78eb xsa45-4.1-04-vcpu-reset-preemptible.patch
aa5b1d56a72dcd44d6523d272328418ed1eb03f818a8c6d359d0b371e75884e5 xsa45-4.1-05-set-info-guest-preemptible.patch
b218608e388eacf4af4707ec2e395b8147e650217dfc0070a69221327b1a802b xsa45-4.1-06-unpin-preemptible.patch
a16ff16c6bd627588606141c94c74694d9f15a65a234dfec366796778d61b77f xsa45-4.1-07-mm-error-paths-preemptible.patch
760d8502747f2c03fb3bf6b683994860ae99b66a2fb6bbedebcc5b440404c404 xsa45-4.2-01-vcpu-destroy-pagetables-preemptible.patch
e8e20bc35017bbfa350c29cef848e294acc782c3eae8082e629b020563b3a2c1 xsa45-4.2-02-new-guest-cr3-preemptible.patch
8f2efcd018179ff8abdd54164980fdb0d25968017aaf91947ff0a326a132cd90 xsa45-4.2-03-new-user-base-preemptible.patch
6eaefb1987f1ccf891cd68c03e9966bc7ccc6fd894ed2c366aa4a0d1f3a15459 xsa45-4.2-04-vcpu-reset-preemptible.patch
406e3bd7147fea805bdf6f201bc17322cd2cd662ede094b1a039ba71b095bb3e xsa45-4.2-05-set-info-guest-preemptible.patch
6e4344e3dcb544537bbef869a34cff38a4611cddc34d18469633d3b3d35db78b xsa45-4.2-06-unpin-preemptible.patch
7fca1b6025d6ac1a444333b2fe1381af093ca601ac8045f68a29c2a83d520e48 xsa45-4.2-07-mm-error-paths-preemptible.patch
530671cc49c2c932ddf63f02500a918a96e4b771d2faf34ef08ca7370cda5b0e xsa45-unstable-01-vcpu-destroy-pagetables-preemptible.patch
5938d69fbf4c69d598c073e942da5738790609d1b44fe2cb659fcc51d38b7b3d xsa45-unstable-02-new-guest-cr3-preemptible.patch
42c218484f38655d7b2fae0ecaac8178c0b1599a6b816512137d1ba50226b142 xsa45-unstable-03-new-user-base-preemptible.patch
5b3bf55c9f8137f20c192c9961031064d960599526c8617eb348394ee4af2f66 xsa45-unstable-04-vcpu-reset-preemptible.patch
95616fb041f79a0f9e792e613d8fd8c1d254d0875e32f78b9a98cebd2a28a870 xsa45-unstable-05-set-info-guest-preemptible.patch
1bcf73a162605efca8ba1422dd40e431cc5f667d97418c735eb5f9230fadef95 xsa45-unstable-06-unpin-preemptible.patch
ce3c0f2b767553103d5afa70148b527dbe8f2320b19733f4474da2835813b16f xsa45-unstable-07-mm-error-paths-preemptible.patch
$
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
iQEcBAEBAgAGBQJRgmx5AAoJEIP+FMlX6CvZZAYH+wWjoD7gudFJI3NgOZSRwfQW
ptXqA+s/hYzjkQHLCYkRqMx7oonAo40XYfARzsQWZy8eQvxc/EaIQezz+WFJrIx+
1D0wPppD2bBhDOOuhUVkftaE3jPdv4BbC1WwZZa96j9jfcRZzdgBtigeUEGmZ+pw
M/Vx2e179dy/EzSBHWnaHLK4X1lf1NF7i+OMFKj6XctUrs6ZvXcu+KA8VyVl8kAj
a+dcZNDHRkQGMNuFhtIW3NSxpcencB1i0SbkcbeWhMHRdu48G1a+Cyds2UXZKHyy
B5Voc3VQtyCwwCKZ7N9zy7cvf+8cAJ8C45h26TscuRqRO5pu9tim0IAoxh9d/zM=
=PK/a
-----END PGP SIGNATURE-----
Download attachment "xsa45-4.1-01-vcpu-destroy-pagetables-preemptible.patch" of type "application/octet-stream" (7247 bytes)
Download attachment "xsa45-4.1-02-new-guest-cr3-preemptible.patch" of type "application/octet-stream" (4573 bytes)
Download attachment "xsa45-4.1-03-new-user-base-preemptible.patch" of type "application/octet-stream" (2574 bytes)
Download attachment "xsa45-4.1-04-vcpu-reset-preemptible.patch" of type "application/octet-stream" (5790 bytes)
Download attachment "xsa45-4.1-05-set-info-guest-preemptible.patch" of type "application/octet-stream" (6272 bytes)
Download attachment "xsa45-4.1-06-unpin-preemptible.patch" of type "application/octet-stream" (4291 bytes)
Download attachment "xsa45-4.1-07-mm-error-paths-preemptible.patch" of type "application/octet-stream" (8145 bytes)
Download attachment "xsa45-4.2-01-vcpu-destroy-pagetables-preemptible.patch" of type "application/octet-stream" (7179 bytes)
Download attachment "xsa45-4.2-02-new-guest-cr3-preemptible.patch" of type "application/octet-stream" (4941 bytes)
Download attachment "xsa45-4.2-03-new-user-base-preemptible.patch" of type "application/octet-stream" (2621 bytes)
Download attachment "xsa45-4.2-04-vcpu-reset-preemptible.patch" of type "application/octet-stream" (5813 bytes)
Download attachment "xsa45-4.2-05-set-info-guest-preemptible.patch" of type "application/octet-stream" (6257 bytes)
Download attachment "xsa45-4.2-06-unpin-preemptible.patch" of type "application/octet-stream" (4291 bytes)
Download attachment "xsa45-4.2-07-mm-error-paths-preemptible.patch" of type "application/octet-stream" (8129 bytes)
Download attachment "xsa45-unstable-01-vcpu-destroy-pagetables-preemptible.patch" of type "application/octet-stream" (6954 bytes)
Download attachment "xsa45-unstable-02-new-guest-cr3-preemptible.patch" of type "application/octet-stream" (5135 bytes)
Download attachment "xsa45-unstable-03-new-user-base-preemptible.patch" of type "application/octet-stream" (2621 bytes)
Download attachment "xsa45-unstable-04-vcpu-reset-preemptible.patch" of type "application/octet-stream" (7044 bytes)
Download attachment "xsa45-unstable-05-set-info-guest-preemptible.patch" of type "application/octet-stream" (6336 bytes)
Download attachment "xsa45-unstable-06-unpin-preemptible.patch" of type "application/octet-stream" (4303 bytes)
Download attachment "xsa45-unstable-07-mm-error-paths-preemptible.patch" of type "application/octet-stream" (8229 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
