Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Thu, 08 Sep 2016 12:05:00 +0000
From: security team <>
CC: security team <>
Subject: Xen Security Advisory 187 (CVE-2016-7094) - x86 HVM: Overflow of

Hash: SHA1

            Xen Security Advisory CVE-2016-7094 / XSA-187
                              version 3

                x86 HVM: Overflow of sh_ctxt->seg_reg[]


Fix the backports xsa187-4.6-0002-*.patch and xsa187-4.4-0002-*.patch.
In v1 and v2 these did not compile in debug builds.  (Debug builds
should not be used in production.)

Public release.


x86 HVM guests running with shadow paging use a subset of the x86 emulator to
handle the guest writing to its own pagetables.  There are situations a guest
can provoke which result in exceeding the space allocated for internal state.


A malicious HVM guest administrator can cause Xen to fail a bug check,
causing a denial of service to the host.


All versions of Xen are vulnerable.

The vulnerability is only exposed to HVM guests on x86 hardware, which are
configured to run with shadow paging.

The vulnerability is not exposed to x86 PV guests, x86 HVM guests running with
hardware assisted paging, or ARM guests.

x86 HVM guests run in HAP mode by default on modern CPUs.

To discover whether your HVM guests are using HAP, or shadow page
tables: request debug key `q' (from the Xen console, or with
`xl debug-keys q').  This will print (to the console, and visible in
`xl dmesg'), debug information for every domain, containing something
like this:

  (XEN) General information for domain 2:
  (XEN)     refcnt=1 dying=2 pause_count=2
  (XEN)     nr_pages=2 xenheap_pages=0 shared_pages=0 paged_pages=0 dirty_cpus={} max_pages=262400
  (XEN)     handle=ef58ef1a-784d-4e59-8079-42bdee87f219 vm_assist=00000000
  (XEN)     paging assistance: hap refcounts translate external
The presence of `hap' here indicates that the host is not
vulnerable to this domain.  For an HVM domain the presence of `shadow'
indicates that the domain can exploit the vulnerability.


Running only PV guests will avoid this vulnerability.

On hardware which supports Hardware Assisted Paging, configuring the
guests to not run with shadow paging will avoid this vulnerability.


This issue was discovered by Andrew Cooper of Citrix.


Applying the first patch will resolve this issue.

The second patch provides additional assurance that the vulnerability
is truly eliminated and that there are no related problems.

If hotpatching, applying only the first patch is recommended since the
second patch is awkward for hotpatching.  If deploying new builds,
applying both patches is recommended.

Xen version     First patch               Second patch
 xen-unstable:   xsa187-0001-*.patch       xsa187-0002-*.patch
 Xen 4.7.x:      xsa187-4.7-0001-*.patch   xsa187-4.7-0002-*.patch
 Xen 4.6.x:      xsa187-4.7-0001-*.patch   xsa187-4.6-0002-*.patch
 Xen 4.5.x:      xsa187-4.7-0001-*.patch   xsa187-4.6-0002-*.patch
 Xen 4.4.x:      xsa187-4.7-0001-*.patch   xsa187-4.4-0002-*.patch

$ sha256sum xsa187*
65205ee195699d65884af04083ffb86c6ddbc96cbca3141c87f6b2d671de45a3  xsa187-0001-x86-shadow-Avoid-overflowing-sh_ctxt-seg_reg.patch
f90e6d13385fb9219e1e26e3a148d1670aefc7130e0639415d08bbb6a1d9efee  xsa187-0002-x86-segment-Bounds-check-accesses-to-emulation-ctxt-.patch
727b18ae83001f7ea04613aa7199ada3e6a84939aa44516f7c426e609d383b2a  xsa187-4.4-0002-x86-segment-Bounds-check-accesses-to-emulation-ctx.patch
b96731379ea77d49ffff31d969f4742dde985ef7a86af9422dcac8327c2a1916  xsa187-4.6-0002-x86-segment-Bounds-check-accesses-to-emulation-ctx.patch
be9fe85d36c2c1fbca246c1f4d834c3ef11b6ab3d5467da0ac8c079aa5a68de9  xsa187-4.7-0001-x86-shadow-Avoid-overflowing-sh_ctxt-seg.patch
36b22d6a168be39f31a1c1304f708269a2a10fe5105f7da4a06877d6059f1cd6  xsa187-4.7-0002-x86-segment-Bounds-check-accesses-to-emulation-ctx.patch


Deployment of the "reconfigure to use HAP" MITIGATION is NOT permitted
(except where all the affected systems and VMs are administered and
used only by organisations which are members of the Xen Project
Security Issues Predisclosure List).  Specifically, deployment on
public cloud systems is NOT permitted.

This is because the mitigation result in guest-visible changes.

Deployment of this mitigation is permitted only AFTER the embargo

Deployment of the PATCHES described above (or others which are
substantially similar) is permitted during the embargo, even on
public-facing systems with untrusted guest users and administrators.

But: Distribution of updated software is prohibited (except to other
members of the predisclosure list).

Predisclosure list members who wish to deploy significantly different
patches and/or mitigations, please contact the Xen Project Security

(Note: this during-embargo deployment notice is retained in
post-embargo publicly released Xen Project advisories, even though it
is then no longer applicable.  This is to enable the community to have
oversight of the Xen Project Security Team's decisionmaking.)

For more information about permissible uses of embargoed information,
consult the Xen Project community's agreed Security Policy:
Version: GnuPG v1


Download attachment "xsa187-0001-x86-shadow-Avoid-overflowing-sh_ctxt-seg_reg.patch" of type "application/octet-stream" (1887 bytes)

Download attachment "xsa187-0002-x86-segment-Bounds-check-accesses-to-emulation-ctxt-.patch" of type "application/octet-stream" (6481 bytes)

Download attachment "xsa187-4.4-0002-x86-segment-Bounds-check-accesses-to-emulation-ctx.patch" of type "application/octet-stream" (5065 bytes)

Download attachment "xsa187-4.6-0002-x86-segment-Bounds-check-accesses-to-emulation-ctx.patch" of type "application/octet-stream" (5061 bytes)

Download attachment "xsa187-4.7-0001-x86-shadow-Avoid-overflowing-sh_ctxt-seg.patch" of type "application/octet-stream" (1538 bytes)

Download attachment "xsa187-4.7-0002-x86-segment-Bounds-check-accesses-to-emulation-ctx.patch" of type "application/octet-stream" (5632 bytes)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.