Bug 1880158 (CVE-2020-25602)

Summary: CVE-2020-25602 xen: x86 pv: Crash when handling guest access to MSR_MISC_ENABLE (XSA-333)
Product: [Other] Security Response Reporter: Guilherme de Almeida Suckevicz <gsuckevi>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED NOTABUG QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: acaringi, ailan, bhu, bmasney, brdeoliv, dhoward, drjones, dvlasenk, fhrbata, hkrzesin, imammedo, jforbes, jshortt, jstancek, knoel, m.a.young, mrezanin, nmurray, pbonzini, ptalbert, robinlee.sysu, rvrbovsk, security-response-team, vkuznets, xen-maint
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in Xen, specifically when a guest accesses certain Model Specific Registers where Xen first reads the value from hardware to use as the basis for auditing the guest access. For the MISC_ENABLE MSR, an Intel specific MSR, this MSR read is performed without error handling for a #GP fault, which is the consequence of trying to read this MSR on non-Intel hardware. This flaw allows an unprivileged guest to crash Xen, leading to a denial of service (DoS) for the entire system. The highest threat from this vulnerability is to system availability.
 Story Points: ---
Clone Of: Environment:
Last Closed: 2020-09-22 20:41:46 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1881619    
Bug Blocks: 1877386    

Description Guilherme de Almeida Suckevicz 2020-09-17 19:41:50 UTC 
When a guest accesses certain Model Specific Registers, Xen first reads the value from hardware to use as the basis for auditing the guest access.

For the MISC_ENABLE MSR, which is an Intel specific MSR, this MSR read is performed without error handling for a #GP fault, which is the consequence of trying to read this MSR on non-Intel hardware.
Comment 1 Guilherme de Almeida Suckevicz 2020-09-17 19:41:55 UTC 
Acknowledgments:

Name: the Xen project
Comment 2 Mauro Matteo Cascella 2020-09-18 16:41:11 UTC 
Statement:

Only x86 systems which do not implement the MISC_ENABLE MSR (0x1a0) are vulnerable and only Xen versions 4.11 and onwards are vulnerable. Red Hat Enterprise Linux 5 is not affected by this flaw, as it shipped an older version of Xen.
Comment 3 Mauro Matteo Cascella 2020-09-18 16:41:13 UTC 
Mitigation:

Running only HVM/PVH guests avoids the vulnerability.
Comment 4 Mauro Matteo Cascella 2020-09-22 18:30:04 UTC 
Created xen tracking bugs for this issue:

Affects: fedora-all [bug 1881619]
Comment 5 Product Security DevOps Team 2020-09-22 20:41:46 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-25602
Comment 6 Mauro Matteo Cascella 2020-09-23 07:37:55 UTC 
External References:

https://xenbits.xen.org/xsa/advisory-333.html