Bug 1780558 (CVE-2019-19579)

Summary: CVE-2019-19579 xen: an untrusted domain with access to a physical device can DMA into host memory, leading to privilege escalation
Product: [Other] Security Response Reporter: Marian Rehak <mrehak>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED WONTFIX QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: acaringi, ailan, bhu, brdeoliv, dhoward, drjones, dvlasenk, fhrbata, hkrzesin, imammedo, jforbes, jshortt, jstancek, knoel, m.a.young, mrezanin, nmurray, pbonzini, rkrcmar, robinlee.sysu, rvrbovsk, vkuznets, xen-maint
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2020-02-18 20:09:36 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 1780559    
Bug Blocks: 1791290    

Description Marian Rehak 2019-12-06 11:43:55 UTC
XSA-302 relies on the use of libxl's "assignable-add" feature to prepare devices to be assigned to untrusted guests. However this is not a strictly required step. The PCI passthrough documentation on the wiki describes alternate ways of preparing devices for assignment. Hosts where these methods are used will still leave the system in a vulnerable state after the device comes back from a guest.

Upstream Reference:


Comment 1 Marian Rehak 2019-12-06 11:44:07 UTC
Created xen tracking bugs for this issue:

Affects: fedora-all [bug 1780559]

Comment 2 Product Security DevOps Team 2020-02-18 20:09:36 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):