|Summary:||CVE-2015-8555 xsa165 xen: information leak in legacy x86 FPU/XMM initialization (XSA-165)|
|Product:||[Other] Security Response||Reporter:||Martin Prpič <mprpic>|
|Component:||vulnerability||Assignee:||Red Hat Product Security <security-response-team>|
|Status:||CLOSED WONTFIX||QA Contact:|
|Fixed In Version:||Doc Type:||Bug Fix|
|Doc Text:||Story Points:||---|
|Last Closed:||2018-03-07 10:37:40 UTC||Type:||---|
|oVirt Team:||---||RHEL 7.3 requirements from Atomic Host:|
|Cloudforms Team:||---||Target Upstream Version:|
|Bug Depends On:||1292439|
Description Martin Prpič 2015-12-07 13:55:19 UTC
ISSUE DESCRIPTION ================= When XSAVE/XRSTOR are not in use by Xen to manage guest extended register state, the initial values in the FPU stack and XMM registers seen by the guest upon first use are those left there by the previous user of those registers. IMPACT ====== A malicious domain may be able to leverage this to obtain sensitive information such as cryptographic keys from another domain. VULNERABLE SYSTEMS ================== All Xen versions are vulnerable. Only x86 systems without XSAVE support or with XSAVE support disabled are vulnerable. ARM systems are not vulnerable. MITIGATION ========== On XSAVE capable systems, not turning off XSAVE support via the "no-xsave" hypervisor command line option (or - when defaulting to off - turning it on via the "xsave" hypervisor command line option) will avoid the vulnerability. To find out whether XSAVE is in use, consult the hypervisor log (obtainable e.g. via "xl dmesg") and look for a message of the form "xstate_init: using cntxt_size: <number> and states: <number>" If such a message is present then XSAVE is in use. But note that due to log buffer size restrictions this boot time message may have scrolled off. There is no known mitigation on XSAVE-incapable systems. External References: http://xenbits.xen.org/xsa/advisory-165.html Acknowledgements: Red Hat would like to thank the Xen project for reporting this issue.
Comment 1 Martin Prpič 2015-12-17 13:15:53 UTC
Created xen tracking bugs for this issue: Affects: fedora-all [bug 1292439]
Comment 2 Fedora Update System 2015-12-22 22:00:29 UTC
xen-4.5.2-6.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.
Comment 3 Fedora Update System 2016-01-02 23:20:41 UTC
xen-4.5.2-6.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report.