[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <08301b10-4a1b-447c-9537-aabadf380570@citrix.com>
Date: Tue, 12 Nov 2024 17:22:58 +0000
From: Andrew Cooper <andrew.cooper3@...rix.com>
To: Demi Marie Obenour <demi@...isiblethingslab.com>,
oss-security@...ts.openwall.com, xen-announce@...ts.xen.org,
xen-devel@...ts.xen.org, xen-users@...ts.xen.org
Cc: "Xen.org security team" <security-team-members@....org>
Subject: Re: Xen Security Advisory 464 v2 (CVE-2024-45819) -
libxl leaks data to PVH guests via ACPI tables
On 12/11/2024 5:17 pm, Demi Marie Obenour wrote:
> On Tue, Nov 12, 2024 at 12:05:47PM +0000, Xen Security wrote:
>> Only PVH guests can leverage the vulnerability. HVM and PV guests
>> cannot leverage the vulnerability. Note that PV guests when run inside
>> the (PVH) shim can't leverage the vulnerability.
> Is this unconditional (perhaps because the relevant data gets zeroed out
> by the shim), or does it only apply when the PV guest can't extract data
> from the shim's memory? For instance, 32-bit PV guests aren't security
> supported anymore, but the PV shim isn't supposed to rely on the
> security of the shim itself, only of the rest of the system.
Data are leaked into the PVShim guest, but it is the shim Xen
(exclusively) which has access to the ACPI tables.
The guest which has been shim'd can't architecturally access the leaked
data.
~Andrew
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
