oss-security - Xen Security Advisory 415 v2 (CVE-2022-42310) - Xenstore: Guests can create orphaned Xenstore nodes

Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Message-Id: <E1oppwi-0005Qa-B7@xenbits.xenproject.org>
Date: Tue, 01 Nov 2022 12:00:44 +0000
From: Xen.org security team <security@....org>
To: xen-announce@...ts.xen.org, xen-devel@...ts.xen.org,
 xen-users@...ts.xen.org, oss-security@...ts.openwall.com
CC: Xen.org security team <security-team-members@....org>
Subject: Xen Security Advisory 415 v2 (CVE-2022-42310) - Xenstore: Guests
 can create orphaned Xenstore nodes

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

            Xen Security Advisory CVE-2022-42310 / XSA-415
                               version 2

          Xenstore: Guests can create orphaned Xenstore nodes

UPDATES IN VERSION 2
====================

Public release.

ISSUE DESCRIPTION
=================

By creating multiple nodes inside a transaction resulting in an error,
a malicious guest can create orphaned nodes in the Xenstore data base,
as the cleanup after the error will not remove all nodes already
created. When the transaction is committed after this situation, nodes
without a valid parent can be made permanent in the data base.

IMPACT
======

A malicious guest can cause inconsistencies in the xenstored data base,
resulting in unusual error responses or memory leaks in xenstored. This
can finally cause Denial of Service situations or long running error
recoveries of xenstored.

VULNERABLE SYSTEMS
==================

Systems with Xen version 4.9 and newer running the C variant of Xenstore
(xenstored or xenstore-stubdom) are vulnerable.

Systems using the Ocaml variant of Xenstore (oxenstored) are not vulnerable.

MITIGATION
==========

Using oxenstored will avoid the vulnerability.

CREDITS
=======

This issue was discovered by Julien Grall of Amazon.

RESOLUTION
==========

Applying the appropriate attached patch resolves this issue.

Note that patches for released versions are generally prepared to
apply to the stable branches, and may not apply cleanly to the most
recent release tarball.  Downstreams are encouraged to update to the
tip of the stable branch before applying these patches.

xsa415.patch           xen-unstable, Xen 4.16.x
xsa415-4.15.patch      Xen 4.15.x
xsa415-4.14.patch      Xen 4.14.x - 4.13.x

$ sha256sum xsa415*
ff973fd3d0af2b45ba46ba74410204a60fcba30b0d0830c591dc827eac9ae484  xsa415.meta
bc5b33bbef18c0fb15d6da6760ece9ef7f6f2cfab78664aee533ff717b379e3b  xsa415.patch
243e7e35ba94973252a6381977af2cf70774abfd0bfd5d0015179b94c832453e  xsa415-4.14.patch
7b18b510b811551025cd2a86d654ee776b5003172ab468e7e86a0c6d892f4629  xsa415-4.15.patch
$

DEPLOYMENT DURING EMBARGO
=========================

Deployment of the patches and/or mitigations described above (or
others which are substantially similar) is permitted during the
embargo, even on public-facing systems with untrusted guest users and
administrators.

But: Distribution of updated software is prohibited (except to other
members of the predisclosure list).

Predisclosure list members who wish to deploy significantly different
patches and/or mitigations, please contact the Xen Project Security
Team.


(Note: this during-embargo deployment notice is retained in
post-embargo publicly released Xen Project advisories, even though it
is then no longer applicable.  This is to enable the community to have
oversight of the Xen Project Security Team's decisionmaking.)

For more information about permissible uses of embargoed information,
consult the Xen Project community's agreed Security Policy:
  http://www.xenproject.org/security-policy.html
-----BEGIN PGP SIGNATURE-----

iQFABAEBCAAqFiEEI+MiLBRfRHX6gGCng/4UyVfoK9kFAmNg+6IMHHBncEB4ZW4u
b3JnAAoJEIP+FMlX6CvZm88H/inrzV4zw8Po/g59rq1hUrCE/L4KwAemf5ZmWMK8
Unka74TyN2j47wous4EbBstzQQtOvf7GP2OT68qpIlqaZSAGcu+7x6TPx3M8q8kM
ZFzqcDYvNye8KrUCNp9pVJIV2Y8b3JLAZXCvxxGK++yECGMjTh5ZkxzdiNK/t9NO
+TmhH7CHFzkiO25Ch/8+vlwMs6eH/rKFLUVbEU/ZiD9L/P84xQr1EORhAhDJorx1
SLyprG0BlaCUIA/YbQVEftqHiG0J6ikuBYJGBHyQGVEV/MqSXGCUB/Eee6nzH4fH
1USXmeQ27OMsKwOJXyxFvrCgmKdeTNDcx0KSzSPFrED9rSc=
=hu/k
-----END PGP SIGNATURE-----

Download attachment "xsa415.meta" of type "application/octet-stream" (1485 bytes)

Download attachment "xsa415.patch" of type "application/octet-stream" (4860 bytes)

Download attachment "xsa415-4.14.patch" of type "application/octet-stream" (4899 bytes)

Download attachment "xsa415-4.15.patch" of type "application/octet-stream" (4865 bytes)
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.