[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <4FDB4567.1040502@coochey.net>
Date: Fri, 15 Jun 2012 15:23:35 +0100
From: Giles Coochey <giles@...chey.net>
To: oss-security@...ts.openwall.com
Subject: Re: Xen Security Advisory 9 (CVE-2012-2934) - PV guest
host DoS (AMD erratum #121)
On 14/06/2012 19:20, Florian Weimer wrote:
> * Xen org security team:
>
>> There is no software fix for this issue. The workaround suggested by
>> AMD in erratum #121 cannot be applied to Xen since the relevant address
>> is under guest control.
>>
>> Applying the patch will cause Xen to detect vulnerable systems and
>> refuse to boot.
> This response puzzles me. Isn't this changing a potential denial of
> service (a para-virtualized guest could attempt an exploit) to a
> definite one (the system won't boot)? Why is this a good idea?
It ensures that the user of the system is aware of the risks.
This position will only occur when the patch to the vulnerability is
applied (i.e. during an out of service upgrade). The admins of the
system should always read the release notes to patches and upgrades -
otherwise they wouldn't know what else might be broken, deprecated.
I think it's the right approach.
--
Regards,
Giles Coochey, CCNA, CCNAS
NetSecSpec Ltd
+44 (0) 7983 877438
http://www.coochey.net
http://www.netsecspec.co.uk
giles@...chey.net
Download attachment "smime.p7s" of type "application/pkcs7-signature" (4928 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
