Bug 858724
Summary: | kernel: xen: change the default behaviour of CVE-2012-2934 fix | ||
---|---|---|---|
Product: | Red Hat Enterprise Linux 5 | Reporter: | Petr Matousek <pmatouse> |
Component: | kernel-xen | Assignee: | Petr Matousek <pmatouse> |
Status: | CLOSED ERRATA | QA Contact: | Virtualization Bugs <virt-bugs> |
Severity: | high | Docs Contact: | |
Priority: | high | ||
Version: | 5.9 | CC: | dhoward, drjones, imammedo, jpallich, leiwang, lersek, moli, pbonzini, qguan, security-response-team, tburke, wshi, xen-maint, yuzhou |
Target Milestone: | rc | Keywords: | ZStream |
Target Release: | --- | ||
Hardware: | x86_64 | ||
OS: | Other | ||
Whiteboard: | |||
Fixed In Version: | kernel-2.6.18-341.el5 | Doc Type: | Bug Fix |
Doc Text: |
This update changes Xen hypervisor's behavior introduced in the CVE-2012-2934 issue: the host was prevented from booting on AMD processors with the AMD #121 erratum applied. Users were prompted to pass the "allow_unsafe" parameter on the command line to allow booting the Xen host. However, this could prevent remotely managed hosts from being started. With this update, the boot process is no longer denied by default; only guest creation is denied. The allow_unsafe semantics has changed to allow creation of guests instead of allowing booting the host.
|
Story Points: | --- |
Clone Of: | Environment: | ||
Last Closed: | 2013-01-08 04:43:19 UTC | Type: | Bug |
Regression: | --- | Mount Type: | --- |
Documentation: | --- | CRM: | |
Verified Versions: | Category: | --- | |
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
Cloudforms Team: | --- | Target Upstream Version: | |
Embargoed: | |||
Bug Depends On: | 824966 | ||
Bug Blocks: | 813442, 859946 |
Description
Petr Matousek
2012-09-19 13:55:11 UTC
This request was evaluated by Red Hat Product Management for inclusion in a Red Hat Enterprise Linux release. Product Management has requested further review of this request by Red Hat Engineering, for potential inclusion in a Red Hat Enterprise Linux release for currently deployed products. This request is not yet committed for inclusion in a release. Patch(es) available in kernel-2.6.18-341.el5 You can download this test kernel (or newer) from http://people.redhat.com/plougher/el5/ Detailed testing feedback is always welcomed. If you require guidance regarding testing, please ask the bug assignee. reproduce: ---------- HOST:2.6.18-340.el5xen Guest:2.6.32-267.el6.bz813428.x86_64 can't boot the dom0 on AMD Opteron(tm) Processor 246 append hypervisor parameter kernel /xen.gz-2.6.18-340.el5 allow_unsafe=on dom0 could launch up successfully, and we could create domU. verified: --------- HOST:2.6.18-341.el5xen Guest:2.6.32-267.el6.bz813428.x86_64 # xm cr xm-test.conf Using config file "./xm-test.conf". Using <class 'grub.GrubConf.GrubConfigFile'> to parse /grub/menu.lst Error: (12, 'Cannot allocate memory') dom0 could boot up without allow_unsafe parameter but we can't create any domU. (In reply to comment #9) > reproduce: > ---------- > HOST:2.6.18-340.el5xen > Guest:2.6.32-267.el6.bz813428.x86_64 > > can't boot the dom0 on AMD Opteron(tm) Processor 246 > > append hypervisor parameter > kernel /xen.gz-2.6.18-340.el5 allow_unsafe=on > > dom0 could launch up successfully, and we could create domU. > > > verified: > --------- > HOST:2.6.18-341.el5xen > Guest:2.6.32-267.el6.bz813428.x86_64 > > # xm cr xm-test.conf > Using config file "./xm-test.conf". > Using <class 'grub.GrubConf.GrubConfigFile'> to parse /grub/menu.lst > Error: (12, 'Cannot allocate memory') > > dom0 could boot up without allow_unsafe parameter but we can't create any > domU. With the latest kernel: HOST:2.6.18-344.el5xen Guest:2.6.32-267.el6.bz813428.x86_64 # xm cr xm-test.conf Using config file "./xm-test.conf". Using <class 'grub.GrubConf.GrubConfigFile'> to parse /grub/menu.lst Error: (12, 'Cannot allocate memory') Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHBA-2013-0006.html |