This service will be undergoing maintenance at 00:00 UTC, 2016-08-01. It is expected to last about 1 hours
Bug 843570 - (CVE-2012-3432) CVE-2012-3432 kernel: xen: HVM guest user mode MMIO emulation DoS
CVE-2012-3432 kernel: xen: HVM guest user mode MMIO emulation DoS
Status: CLOSED NOTABUG
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
medium Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
impact=moderate,public=20120726,repor...
: Security
Depends On: 843574 843575 843766
Blocks: 843578
  Show dependency treegraph
 
Reported: 2012-07-26 12:16 EDT by Petr Matousek
Modified: 2015-02-16 10:41 EST (History)
27 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2012-07-27 04:29:04 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:


Attachments (Terms of Use)
Xen Security Advisory #10 (1.97 KB, application/x-gzip)
2012-07-26 12:35 EDT, Petr Matousek
no flags Details

  None (edit)
Description Petr Matousek 2012-07-26 12:16:52 EDT
Description of the problem:

Internal data of the emulator for MMIO operations may, under
certain rare conditions, at the end of one emulation cycle be left
in a state affecting a subsequent emulation such that this second
emulation would fail, causing an exception to be reported to the
guest kernel where none is expected.

Guest mode unprivileged (user) code, which has been granted
the privilege to access MMIO regions, may leverage that access
to crash the whole guest.

Only HVM guests exposing MMIO ranges to unprivileged (user) mode
are vulnerable to this issue. PV guests are not.

References:
http://seclists.org/oss-sec/2012/q3/119

Acknowledgements:

Red Hat would like to thank the Xen for reporting this issue.
Comment 1 Petr Matousek 2012-07-26 12:23:14 EDT
Statement:

Not vulnerable.

The versions of the Linux kernel as shipped with Red Hat Enterprise Linux 5, 6,
and Red Hat Enterprise MRG are not affected. 

The versions of the kernel-xen packages as shipped with Red Hat Enterprise Linux 5 are not affected as they implement a different MMIO emulation mechanism.
Comment 3 Petr Matousek 2012-07-26 12:35:02 EDT
Created attachment 600554 [details]
Xen Security Advisory #10
Comment 4 Paolo Bonzini 2012-07-27 04:29:04 EDT
RHEL is not affected, MMIO is handled in a simpler way.
Comment 5 Petr Matousek 2012-07-27 06:03:06 EDT
Created xen tracking bugs for this issue

Affects: fedora-all [bug 843766]
Comment 6 Fedora Update System 2012-08-05 17:26:19 EDT
xen-4.1.2-24.fc17 has been pushed to the Fedora 17 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 7 Fedora Update System 2012-08-05 17:31:28 EDT
xen-4.1.2-9.fc16 has been pushed to the Fedora 16 stable repository.  If problems still persist, please make note of it in this bug report.

Note You need to log in before you can comment on or make changes to this bug.