Bug 1339123 (CVE-2014-3672)

Summary: CVE-2014-3672 xen: Unrestricted qemu logging
Product: [Other] Security Response Reporter: Andrej Nemec <anemec>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED WONTFIX QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: abaron, ailan, alonbl, amit.shah, aortega, apevec, areis, ayoung, berrange, cfergeau, chrisw, cvsbot-xmlrpc, drjones, dwmw2, imammedo, itamar, jen, jjoyce, jschluet, kbasil, knoel, lhh, lpeer, markmc, m.a.young, mkenneth, mrezanin, mst, pbonzini, ppandit, rbalakri, rbryant, rjones, rkrcmar, sclewis, srevivo, tdecacqu, virt-maint, virt-maint, vkuznets, xen-maint, ykaul, ylavi
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2016-05-31 09:33:44 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1339124, 1339125    
Bug Blocks: 1148050, 1339130    

Description Andrej Nemec 2016-05-24 08:25:53 UTC 
ISSUE DESCRIPTION
=================

When the libxl toolstack launches qemu for HVM guests, it pipes the
output of stderr to a file in /var/log/xen.  This output is not
rate-limited in any way.  The guest can easily cause qemu to print
messages to stderr, causing this file to become arbitrarily large.

IMPACT
======

The disk containing the logfile can be exausted, possibly causing a
denial-of-service (DoS).

VULNERABLE SYSTEMS
==================

All versions of Xen are affected.

Only x86 systems are affected; ARM systems are not affected.

Only systems running HVM guests are affected; systems running only PV
guests are not affected.

Both qemu-upstream and qemu-traditional are affected.

MITIGATION
==========

Running only PV guests will avoid this vulnerability.

References:

http://seclists.org/oss-sec/2016/q2/390
Comment 1 Andrej Nemec 2016-05-24 08:27:39 UTC 
Created xen tracking bugs for this issue:

Affects: fedora-all [bug 1339125]
Comment 2 Andrej Nemec 2016-05-24 08:27:58 UTC 
Created qemu tracking bugs for this issue:

Affects: fedora-all [bug 1339124]
Comment 3 Fedora Update System 2016-05-30 21:19:58 UTC 
xen-4.6.1-10.fc24 has been pushed to the Fedora 24 stable repository. If problems still persist, please make note of it in this bug report.
Comment 4 Fedora Update System 2016-06-05 02:56:38 UTC 
xen-4.5.3-6.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.
Comment 5 Fedora Update System 2016-06-12 22:51:57 UTC 
xen-4.5.3-6.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report.