Bug 1652235 (CVE-2018-19966, XSA-280)

Summary: CVE-2018-19966 xsa280 xen: Conflicts with shadow paging due to XSA-240 incomplete fix (XSA-280)
Product: [Other] Security Response Reporter: Pedro Sampaio <psampaio>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED WONTFIX QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: ailan, drjones, imammedo, jforbes, knoel, m.a.young, mrezanin, pbonzini, rkrcmar, robinlee.sysu, vkuznets, xen-maint
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2019-06-10 10:43:11 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 1652251    
Bug Blocks:    

Description Pedro Sampaio 2018-11-21 18:05:31 UTC

The fix for XSA-240 introduced a new field into the control structure
associated with each page of RAM.  This field was added to a union,
another member of which is used when Xen uses shadow paging for the
guest.  During migration, or with the L1TF (XSA-273) mitigation for
PV guests in effect, the two uses conflict.


A malicious or buggy x86 PV guest may cause Xen to crash, resulting in
a DoS (Denial of Service) affecting the entire host.  Privilege
escalation as well as information leaks cannot be ruled out.


All Xen versions from at least 3.2 onwards are vulnerable.  Earlier
versions have not been checked.

Only x86 systems are affected.  ARM systems are not affected.

Only Xen versions with the XSA-240 fixes applied are vulnerable.

Only Xen versions which permit linear page table use by PV guests are

Only x86 PV guests can leverage this vulnerability.  x86 HVM guests
cannot leverage this vulnerability.


Not permitting linear page table use by PV guests avoids the
vulnerability.  This can be done both at build time, by turning off the
PV_LINEAR_PT configure option, or at runtime, by passing specifying
"pv-linear-pt=0" on the hypervisor command line.

On systems where the guest kernel is controlled by the host rather than
guest administrator, running only kernels which have themselves been
hardened against L1TF _and_ avoiding live migrating or snapshotting PV
guests will generally prevent this issue being triggered.  However
untrusted guest administrators can still trigger it unless further
steps are taken to prevent them from loading code into the kernel
(e.g. by disabling loadable modules etc) or from using other
mechanisms which allow them to run code at kernel privilege.

Running only HVM guests will avoid this vulnerability.



Comment 1 Pedro Sampaio 2018-11-21 18:05:33 UTC

Name: the Xen project
Upstream: Prgmr.com security team

Comment 2 Pedro Sampaio 2018-11-21 18:11:43 UTC
Created xen tracking bugs for this issue:

Affects: fedora-all [bug 1652251]