Bug 1289130 - (CVE-2015-8555, xsa165) CVE-2015-8555 xsa165 xen: information leak in legacy x86 FPU/XMM initialization (XSA-165)
CVE-2015-8555 xsa165 xen: information leak in legacy x86 FPU/XMM initializati...
Status: CLOSED WONTFIX
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
low Severity low
: ---
: ---
Assigned To: Red Hat Product Security
impact=low,public=20151217,reported=2...
: Security
Depends On: 1292439
Blocks: 1290367
  Show dependency treegraph
 
Reported: 2015-12-07 08:55 EST by Martin Prpič
Modified: 2018-03-07 05:37 EST (History)
1 user (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2018-03-07 05:37:40 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Martin Prpič 2015-12-07 08:55:19 EST
ISSUE DESCRIPTION
=================

When XSAVE/XRSTOR are not in use by Xen to manage guest extended
register state, the initial values in the FPU stack and XMM registers
seen by the guest upon first use are those left there by the previous
user of those registers.

IMPACT
======

A malicious domain may be able to leverage this to obtain sensitive
information such as cryptographic keys from another domain.

VULNERABLE SYSTEMS
==================

All Xen versions are vulnerable.

Only x86 systems without XSAVE support or with XSAVE support disabled
are vulnerable.

ARM systems are not vulnerable.

MITIGATION
==========

On XSAVE capable systems, not turning off XSAVE support via the
"no-xsave" hypervisor command line option (or - when defaulting to
off - turning it on via the "xsave" hypervisor command line option)
will avoid the vulnerability.  To find out whether XSAVE is in use,
consult the hypervisor log (obtainable e.g. via "xl dmesg") and look
for a message of the form

"xstate_init: using cntxt_size: <number> and states: <number>"

If such a message is present then XSAVE is in use. But note that due
to log buffer size restrictions this boot time message may have
scrolled off.

There is no known mitigation on XSAVE-incapable systems.

External References:

http://xenbits.xen.org/xsa/advisory-165.html

Acknowledgements:

Red Hat would like to thank the Xen project for reporting this issue.
Comment 1 Martin Prpič 2015-12-17 08:15:53 EST
Created xen tracking bugs for this issue:

Affects: fedora-all [bug 1292439]
Comment 2 Fedora Update System 2015-12-22 17:00:29 EST
xen-4.5.2-6.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.
Comment 3 Fedora Update System 2016-01-02 18:20:41 EST
xen-4.5.2-6.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report.

Note You need to log in before you can comment on or make changes to this bug.