[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <b3afc964-2840-4583-bb39-e05d390d3e55@citrix.com>
Date: Wed, 5 Mar 2025 19:11:23 +0000
From: Andrew Cooper <andrew.cooper3@...rix.com>
To: "xen-announce@...ts.xen.org" <xen-announce@...ts.xen.org>,
Xen-devel <xen-devel@...ts.xen.org>,
"xen-users@...ts.xen.org" <xen-users@...ts.xen.org>,
"oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>
Cc: "Xen.org security team" <security-team-members@....org>
Subject: Xen Security Notice 2 (CVE-2024-35347) AMD CPU Microcode Signature
Verification Vulnerability
See:
https://bughunters.google.com/blog/5424842357473280/zen-and-the-art-of-microcode-hacking
https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7033.html
Right now there are four known but (reasonably) benign microcodes from a
non-AMD source. However, there is a tool to sign arbitrary microcode.
In Xen, we've provided a stopgap mitigation to perform extra checks on
microcode load on affected CPU families. This is a SHA2 digest check
against hashes with believed-good provenance. This is staging only for
now, in case it is overly disruptive.
This will not protect against an already-compromised platform, but it
will prevent an uncompromised system becoming compromised via Xen's
microcode loading capabilities.
On affected systems, the only complete fix is a firmware update. This
is a very firmly recommended course of action.
Sincerely,
~Andrew, on behalf of the Xen Security Team.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
