Bug 1458871 (CVE-2017-10912, xsa217)

Summary: CVE-2017-10912 xsa217 xen: page transfer may allow PV guest to elevate privilege (XSA-217)
Product: [Other] Security Response Reporter: Adam Mariš <amaris>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED WONTFIX QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: ailan, drjones, imammedo, knoel, m.a.young, mrezanin, pbonzini, rkrcmar, robinlee.sysu, security-response-team, virt-maint, vkuznets, xen-maint
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2019-06-08 03:14:28 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 1463247    
Bug Blocks:    

Description Adam Mariš 2017-06-05 17:42:55 UTC
ISSUE DESCRIPTION
=================

Domains controlling other domains are permitted to map pages owned by
the domain being controlled.  If the controlling domain unmaps such a
page without flushing the TLB, and if soon after the domain being
controlled transfers this page to another PV domain (via
GNTTABOP_transfer or, indirectly, XENMEM_exchange), and that third
domain uses the page as a page table, the controlling domain will have
write access to a live page table until the applicable TLB entry is
flushed or evicted.  Note that the domain being controlled is
necessarily HVM, while the controlling domain is PV.

IMPACT
======

A malicious pair of guests may be able to access all of system memory,
allowing for all of privilege escalation, host crashes, and
information leaks.

VULNERABLE SYSTEMS
==================

All Xen versions are vulnerable.

Only x86 systems are affected.  ARM systems are not vulnerable.

Only systems where an attacker can control both a PV and an HVM guest
are vulnerable.  This must be presumed to include systems containing
HVM domains with service domains such as stub domain device models.

Systems containing only PV guests are not vulnerable.

Systems containing only HVM domains serviced by dom0 device model
processes are not vulnerable.  Note that with libxl, xl, and libvirt,
HVM domains use dom0 device model processes by default.

MITIGATION
==========

There is no mitigation for this vulnerability.

Switching from stub device models to dom0 process device models is not
recommended as a mitigation, as in practice the vulnerability is
likely to be hard to exploit through this route; whereas dom0 process
device models may have unknown vulnerabilities.

External References:

http://xenbits.xen.org/xsa/advisory-217.html

Acknowledgements:

Name: the Xen project
Upstream: Jann Horn (Google)

Comment 1 Adam Mariš 2017-06-20 12:34:53 UTC
Created xen tracking bugs for this issue:

Affects: fedora-all [bug 1463247]