Bug 1289130 (CVE-2015-8555, xsa165) - CVE-2015-8555 xsa165 xen: information leak in legacy x86 FPU/XMM initialization (XSA-165)
Summary: CVE-2015-8555 xsa165 xen: information leak in legacy x86 FPU/XMM initializati...
Keywords:
Status: CLOSED WONTFIX
Alias: CVE-2015-8555, xsa165
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard: impact=low,public=20151217,reported=2...
Depends On: 1292439
Blocks: 1290367
TreeView+ depends on / blocked
 
Reported: 2015-12-07 13:55 UTC by Martin Prpič
Modified: 2019-06-08 20:52 UTC (History)
1 user (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2018-03-07 10:37:40 UTC


Attachments (Terms of Use)

Description Martin Prpič 2015-12-07 13:55:19 UTC
ISSUE DESCRIPTION
=================

When XSAVE/XRSTOR are not in use by Xen to manage guest extended
register state, the initial values in the FPU stack and XMM registers
seen by the guest upon first use are those left there by the previous
user of those registers.

IMPACT
======

A malicious domain may be able to leverage this to obtain sensitive
information such as cryptographic keys from another domain.

VULNERABLE SYSTEMS
==================

All Xen versions are vulnerable.

Only x86 systems without XSAVE support or with XSAVE support disabled
are vulnerable.

ARM systems are not vulnerable.

MITIGATION
==========

On XSAVE capable systems, not turning off XSAVE support via the
"no-xsave" hypervisor command line option (or - when defaulting to
off - turning it on via the "xsave" hypervisor command line option)
will avoid the vulnerability.  To find out whether XSAVE is in use,
consult the hypervisor log (obtainable e.g. via "xl dmesg") and look
for a message of the form

"xstate_init: using cntxt_size: <number> and states: <number>"

If such a message is present then XSAVE is in use. But note that due
to log buffer size restrictions this boot time message may have
scrolled off.

There is no known mitigation on XSAVE-incapable systems.

External References:

http://xenbits.xen.org/xsa/advisory-165.html

Acknowledgements:

Red Hat would like to thank the Xen project for reporting this issue.

Comment 1 Martin Prpič 2015-12-17 13:15:53 UTC
Created xen tracking bugs for this issue:

Affects: fedora-all [bug 1292439]

Comment 2 Fedora Update System 2015-12-22 22:00:29 UTC
xen-4.5.2-6.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.

Comment 3 Fedora Update System 2016-01-02 23:20:41 UTC
xen-4.5.2-6.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.