Bug 479042 (CVE-2008-5716)

Summary:	CVE-2008-5716 xen: Incomplete upstream fix for CVE-2008-4405
Product:	[Other] Security Response	Reporter:	Jan Lieskovsky <jlieskov>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED CURRENTRELEASE	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	armbru, bburns, berrange, clalance
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
URL:	http://lists.xensource.com/archives/html/xen-devel/2008-12/msg00842.html
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2009-10-22 16:03:08 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	464817
Bug Blocks:

Description Jan Lieskovsky 2009-01-06 17:48:04 UTC

Common Vulnerabilities and Exposures assigned an identifier CVE-2008-5716 to
the following vulnerability:

xend in Xen 3.3.0 does not properly restrict a guest VM's write access
within the /local/domain xenstore directory tree, which allows guest
OS users to cause a denial of service and possibly have unspecified
other impact by writing to (1) console/tty, (2) console/limit, or (3)
image/device-model-pid.  NOTE: this issue exists because of erroneous
set_permissions calls in the fix for CVE-2008-4405.


References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5716
http://openwall.com/lists/oss-security/2008/12/19/1
http://lists.xensource.com/archives/html/xen-devel/2008-12/msg00842.html
http://lists.xensource.com/archives/html/xen-devel/2008-12/msg00845.html
http://lists.xensource.com/archives/html/xen-devel/2008-12/msg00846.html
http://lists.xensource.com/archives/html/xen-devel/2008-12/msg00847.html

Patch from Daniel P.Berrange is available here:
http://lists.xensource.com/archives/html/xen-devel/2008-12/msg00842.html

Comment 1 Jan Lieskovsky 2009-01-06 17:49:49 UTC

This issue affects the version of the Xen package, as shippped with
Red Hat Enteprise Linux 5.

This issue affects the versions of the Xen package, as shipped with
Fedora releases of 9, 10 and devel.

Comment 2 Daniel Berrangé 2009-01-06 18:01:33 UTC

This is already address in RHEL-5.3 and RHEL-5.2.x  z-stream, when QA identified that our proposed original fix didn't pass the tests

See 5.3:

* Thu Dec 18 2008 Daniel P. Berrange <berrange> - 3.0.3-80.el5
- More fixes for Xenstore unsafe data access (CVE-2008-4405, rhbz #464817)

And for 5.2.1

* Thu Dec 18 2008 Daniel P. Berrange <berrange> - 3.0.3-64.el5_2.9
- More fixes for Xenstore unsafe data access (CVE-2008-4405, rhbz #464817)


eg, See additional patch applied for bug 465938 comment 8, and bug 465937 comment 6.


We've not fixed the original CVE-2008-4405 bug in Fedora yet, so no need for this new CVE bug there either AFAICT

Comment 4 Tomas Hoger 2009-01-07 12:27:23 UTC

Updated Xen packages were released to address CVE-2008-4405:

  https://rhn.redhat.com/errata/RHSA-2009-0003.html

The patch used in the errata does not introduce the problem known as CVE-2008-5716.

Comment 5 Chris Lalancette 2009-10-22 16:03:08 UTC

OK, this has been long released, so closing out this tracking bug.

Chris Lalancette