Bug 1164255 – CVE-2014-8867 xen: Insufficient bounding of "REP MOVS" to MMIO emulated inside the hypervisor (xsa112)

Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.

Bug 1164255 - (CVE-2014-8867, xsa112) CVE-2014-8867 xen: Insufficient bounding of "REP MOVS" to MMIO emulated inside the hypervisor (xsa112)

Summary:	CVE-2014-8867 xen: Insufficient bounding of "REP MOVS" to MMIO emulated insid...

Status:	NEW

Aliases:	CVE-2014-8867, xsa112

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	high Severity high
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	impact=important,public=20141127,repo...
Keywords:	Security

Depends On:	1164256
Blocks:	1164260
	Show dependency tree / graph

Reported:	2014-11-14 08:27 EST by Petr Matousek
Modified:	2018-08-28 17:56 EDT (History)
CC List:	10 users (show)

See Also:
Fixed In Version:
Doc Type:	Bug Fix
Doc Text:	An insufficient bound checking flaw was found in the Xen hypervisor's implementation of acceleration support for the "REP MOVS" instructions. A privileged HVM guest user could potentially use this flaw to crash the host.
Story Points:	---
Clone Of:
Environment:
Last Closed:
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
upstream patch (3.24 KB, patch) 2014-11-20 18:44 EST, Vincent Danen	no flags	Details \| Diff
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHSA-2015:0783	normal	SHIPPED_LIVE	Important: kernel security and bug fix update	2015-04-07 15:08:19 EDT

Groups: None (edit)

Description Petr Matousek 2014-11-14 08:27:25 EST

Acceleration support for the "REP MOVS" instruction, when the first
iteration accesses memory mapped I/O emulated internally in the
hypervisor, incorrectly assumes that the whole range accessed is
handled by the same hypervisor sub-component.

A buggy or malicious HVM guest can crash the host.

Acknowledgements:

Red Hat would like to thank the Xen project for reporting this issue.

Comment 2 Petr Matousek 2014-11-14 08:28:23 EST

Statement:

This issue does affect the versions of the kernel-xen package as shipped with
Red Hat Enterprise Linux 5. Future kernel-xen updates for Red Hat Enterprise
Linux 5 may address this issue.

Comment 6 Vincent Danen 2014-11-20 18:44:59 EST

Created attachment 959509 [details]
upstream patch

Comment 7 Martin Prpič 2015-04-07 04:55:53 EDT

External References:

http://xenbits.xen.org/xsa/advisory-112.html

Comment 8 errata-xmlrpc 2015-04-07 11:12:06 EDT

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 5

Via RHSA-2015:0783 https://rhn.redhat.com/errata/RHSA-2015-0783.html

Note You need to log in before you can comment on or make changes to this bug.