Bug 1144499 (CVE-2014-7188)

Summary: CVE-2014-7188 kernel: xen: Improper MSR range used for x2APIC emulation (xsa108)
Product: [Other] Security Response Reporter: Petr Matousek <pmatouse>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED NOTABUG QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: drjones, ederevea, imammedo, mickygough, pbonzini, rkrcmar, security-response-team, vkuznets
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2014-09-19 14:34:49 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1148465    
Bug Blocks: 1140259    

Description Petr Matousek 2014-09-19 14:31:52 UTC 
The MSR range specified for APIC use in the x2APIC access model spans
256 MSRs. Hypervisor code emulating read and write accesses to these
MSRs erroneously covered 1024 MSRs. While the write emulation path is
written such that accesses to the extra MSRs would not have any bad
effect (they end up being no-ops), the read path would (attempt to)
access memory beyond the single page set up for APIC emulation.

A buggy or malicious HVM guest can crash the host or read data
relating to other guests or the hypervisor itself.

Acknowledgements:

Red Hat would like to thank the Xen for reporting this issue.
Comment 2 Petr Matousek 2014-09-19 14:34:49 UTC 
Statement:

Not vulnerable.

This issue does not affect the versions of the kernel-xen package as shipped with Red Hat Enterprise Linux 5.
Comment 3 Vasyl Kaigorodov 2014-10-01 12:17:34 UTC 
This is public now: http://seclists.org/oss-sec/2014/q4/7
Comment 4 Petr Matousek 2014-10-01 14:00:40 UTC 
Created xen tracking bugs for this issue:

Affects: fedora-all [bug 1148465]
Comment 5 Fedora Update System 2014-10-08 19:08:50 UTC 
xen-4.4.1-6.fc21 has been pushed to the Fedora 21 stable repository.  If problems still persist, please make note of it in this bug report.