Bug 1590984 (CVE-2018-12892) - CVE-2018-12892 xsa-266 xen: libxl fails to honour readonly flag on HVM emulated SCSI disks
Summary: CVE-2018-12892 xsa-266 xen: libxl fails to honour readonly flag on HVM emulat...
Status: CLOSED NOTABUG
Alias: CVE-2018-12892
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard: impact=moderate,public=20180627,repor...
Keywords: Security
Depends On: 1595957
Blocks: 1590986
TreeView+ depends on / blocked
 
Reported: 2018-06-13 20:48 UTC by Pedro Sampaio
Modified: 2018-06-28 08:46 UTC (History)
13 users (show)

(edit)
Clone Of:
(edit)
Last Closed: 2018-06-28 08:46:59 UTC


Attachments (Terms of Use)

Description Pedro Sampaio 2018-06-13 20:48:10 UTC
Xen Security Advisory XSA-266

libxl fails to honour readonly flag on HVM emulated SCSI disks

*** EMBARGOED UNTIL 2018-06-27 21:00 UTC ***

ISSUE DESCRIPTION
=================

libxl fails to pass the readonly flag to qemu when setting up a SCSI
disk, due to what was probably an erroneous merge conflict resolution.

IMPACT
======

Malicious guest administrators or (in some situations) users may be
able to write to supposedly read-only disk images.

VULNERABLE SYSTEMS
==================

Only emulated SCSI disks (specified as "sd" in the libxl disk
configuration, or an equivalent) are affected. IDE disks ("hd") are
not affected (because attempts to make them readonly are rejected).

Additionally, CDROM devices (that is, devices specified to be
presented to the guest as CDROMs, regardless of the nature of the
backing storage on the host) are not affected; they are always
readonly.

Only systems using qemu-xen (rather than qemu-xen-traditional) as the
device model version are vulnerable.

Only systems using libxl or libxl-based toolstacks are vulnerable.
(This includes xl, and libvirt with the libxl driver.)

The vulnerability is present in Xen versions 4.7 and later.
(In earlier versions, provided that the patch for XSA-142 has been
applied, attempts to create readonly disks are rejected.)

If the host and guest together usually support PVHVM, the issue is
exploitable only if the malicious guest administrator has control of
the guest kernel or guest kernel command line.

MITIGATION
==========

Switching to qemu-xen-traditional will avoid this vulnerability.
This can be done with
device_model_version="qemu-xen-traditional"
in the xl configuration file.

Using stub domain device models (which necessarily involves switching
to qemu-xen-traditional) will also avoid this vulnerability.
This can be done with
device_model_stubdomain_override=true
in the xl configuration file.

All of these mitigations are liable to have other guest-visible
effects or even regressions.

It may be possible, depending on the configuration, to make the
underlying storage object readonly, or to make it reject writes.

Comment 1 Pedro Sampaio 2018-06-13 20:48:16 UTC
Acknowledgments:

Name: the Xen project

Comment 2 Laura Pardo 2018-06-27 22:06:30 UTC
Created xen tracking bugs for this issue:

Affects: fedora-all [bug 1595957]


Note You need to log in before you can comment on or make changes to this bug.