Bug 1289128 - (CVE-2015-8551, CVE-2015-8552, xsa157) CVE-2015-8551 CVE-2015-8552 xsa157 xen: Linux pciback missing sanity checks leading to crash (XSA-157)
CVE-2015-8551 CVE-2015-8552 xsa157 xen: Linux pciback missing sanity checks l...
Status: NEW
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
medium Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
impact=moderate,public=20151217,repor...
: Security
Depends On: 1292439
Blocks: 1290367
  Show dependency treegraph
 
Reported: 2015-12-07 08:55 EST by Martin Prpič
Modified: 2015-12-17 15:23 EST (History)
2 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed:
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Martin Prpič 2015-12-07 08:55:10 EST
ISSUE DESCRIPTION
=================

Xen PCI backend driver does not perform proper sanity checks on the
device's state.

Which in turn allows the generic MSI code (called by Xen PCI backend) to be
called incorrectly leading to hitting BUG conditions or causing NULL pointer
exceptions in the MSI code.

To exploit this the guest can craft specific sequence of XEN_PCI_OP_*
operations which will trigger this.

Furthermore the frontend can also craft an continous stream of
XEN_PCI_OP_enable_msi which will trigger an continous
stream of WARN() messages triggered by the MSI code leading to the logging
in the initial domain to exhaust disk space.

Lastly there is also missing check to verify whether the device has
memory decoding enabled set at the start of the day leading the initial
domain "accesses to the respective MMIO or I/O port ranges would - - on PCI
Express devices - [which can] lead to Unsupported Request responses.
The treatment of such errors is platform specific." (from XSA-120).
Note that if XSA-120 'addendum' patch has been applied this particular
sub-issue is not exploitable.

IMPACT
======

Malicious guest administrators can cause denial of service.  If driver
domains are not in use, the impact is a host crash.

Only x86 systems are vulnerable.  ARM systems are not vulnerable.

VULNERABLE SYSTEMS
==================

This bug affects systems using Linux as the driver domain, including
non-disaggregated systems using Linux as dom0.

Linux versions v3.1 and onwards are vulnerable due to supporting PCI
pass-through backend driver.

PV and HVM guests which have been granted access to physical PCI devices
(`PCI passthrough') can take advantage of this vulnerability.

Furthermore, the vulnerability is only applicable when the
passed-through PCI devices are MSI-capable or MSI-X. (Most modern devices
are).

MITIGATION
==========

Not using PCI passthrough for PV and HVM guests. Note that for HVM guests
QEMU is used for PCI passthrough - however  the toolstack sets up also
the 'PV' PCI which the guest can utilize if it chooses to do so.

External References:

http://xenbits.xen.org/xsa/advisory-157.html

Acknowledgements:

Red Hat would like to thank the Xen project for reporting this issue.
Comment 1 Martin Prpič 2015-12-15 07:56:45 EST
(In reply to Martin Prpic from comment #0)
> ISSUE DESCRIPTION
> =================
> 
> Xen PCI backend driver does not perform proper sanity checks on the
> device's state.
> 
> Which in turn allows the generic MSI code (called by Xen PCI backend) to be
> called incorrectly leading to hitting BUG conditions or causing NULL pointer
> exceptions in the MSI code.

This was assigned CVE-2015-8551.

> 
> To exploit this the guest can craft specific sequence of XEN_PCI_OP_*
> operations which will trigger this.
> 
> Furthermore the frontend can also craft an continous stream of
> XEN_PCI_OP_enable_msi which will trigger an continous
> stream of WARN() messages triggered by the MSI code leading to the logging
> in the initial domain to exhaust disk space.

This was assigned CVE-2015-8552.

> 
> Lastly there is also missing check to verify whether the device has
> memory decoding enabled set at the start of the day leading the initial
> domain "accesses to the respective MMIO or I/O port ranges would - - on PCI
> Express devices - [which can] lead to Unsupported Request responses.
> The treatment of such errors is platform specific." (from XSA-120).
> Note that if XSA-120 'addendum' patch has been applied this particular
> sub-issue is not exploitable.

This was assigned CVE-2015-8553.
Comment 2 Martin Prpič 2015-12-17 08:11:12 EST
"UPDATES IN VERSION 3
====================

Removed CVE-2015-8553 from the title of this advisory.  We will issue
an update to XSA-120 which documents the assignment of CVE-2015-8553
to the XSA-120 v5+ addendum patch."

CVE-2015-8553 has been re-assigned to bug 1196266 (XSA-120).
Comment 3 Martin Prpič 2015-12-17 08:16:02 EST
Created xen tracking bugs for this issue:

Affects: fedora-all [bug 1292439]
Comment 4 Michael Young 2015-12-17 15:23:50 EST
The xsa157 patches are for the xen drivers within the kernel, not for the xen package.

Note You need to log in before you can comment on or make changes to this bug.