Bug 1499817 (CVE-2017-15590, xsa237) - CVE-2017-15590 xsa237 xen: multiple MSI mapping issues on x86 (XSA-237)
Summary: CVE-2017-15590 xsa237 xen: multiple MSI mapping issues on x86 (XSA-237)
Keywords:
Status: CLOSED WONTFIX
Alias: CVE-2017-15590, xsa237
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1501391
Blocks:
TreeView+ depends on / blocked
 
Reported: 2017-10-09 12:51 UTC by Adam Mariš
Modified: 2019-09-29 14:23 UTC (History)
13 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2019-06-08 03:27:07 UTC


Attachments (Terms of Use)

Description Adam Mariš 2017-10-09 12:51:12 UTC
ISSUE DESCRIPTION
=================

Multiple issues exist with the setup of PCI MSI interrupts:
- - unprivileged guests were permitted access to devices not owned by
them, in particular allowing them to disable MSI or MSI-X on any
device
- - HVM guests can trigger a codepath intended only for PV guests
- - some failure paths partially tear down previously configured
interrupts, leaving inconsistent state
- - with XSM enabled, caller and callee of a hook disagreed about the
data structure pointed to by a type-less argument

IMPACT
======

A malicious or buggy guest may cause the hypervisor to crash, resulting
in Denial of Service (DoS) affecting the entire host.  Privilege
escalation and information leaks cannot be excluded.

VULNERABLE SYSTEMS
==================

All Xen versions from at 3.3 onwards are vulnerable.  Xen versions 3.2
and earlier are not vulnerable.

Only x86 systems are affected.  ARM systems are not affected.

Only guests which have a physical device assigned to them can exploit
the vulnerability.

MITIGATION
==========

Not passing through physical devices to untrusted guests will avoid
the vulnerability.

The vulnerability can be avoided if the guest kernel is controlled by
the host rather than guest administrator, provided that further steps
are taken to prevent the guest administrator from loading code into the
kernel (e.g. by disabling loadable modules etc) or from using other
mechanisms which allow them to run code at kernel privilege.

External References:

http://xenbits.xen.org/xsa/advisory-237.html

Comment 1 Adam Mariš 2017-10-12 13:41:15 UTC
Created xen tracking bugs for this issue:

Affects: fedora-all [bug 1501391]

Comment 2 Adam Mariš 2017-10-18 14:46:09 UTC
Acknowledgments:

Name: the Xen project
Upstream: Simon Gaiser (Qubes OS)


Note You need to log in before you can comment on or make changes to this bug.