Bug 858724 - kernel: xen: change the default behaviour of CVE-2012-2934 fix
Summary: kernel: xen: change the default behaviour of CVE-2012-2934 fix
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 5
Classification: Red Hat
Component: kernel-xen
Version: 5.9
Hardware: x86_64
OS: Other
high
high
Target Milestone: rc
: ---
Assignee: Petr Matousek
QA Contact: Virtualization Bugs
URL:
Whiteboard:
Depends On: CVE-2012-2934
Blocks: 813442 859946
TreeView+ depends on / blocked
 
Reported: 2012-09-19 13:55 UTC by Petr Matousek
Modified: 2013-01-10 01:09 UTC (History)
14 users (show)

Fixed In Version: kernel-2.6.18-341.el5
Doc Type: Bug Fix
Doc Text:
This update changes Xen hypervisor's behavior introduced in the CVE-2012-2934 issue: the host was prevented from booting on AMD processors with the AMD #121 erratum applied. Users were prompted to pass the "allow_unsafe" parameter on the command line to allow booting the Xen host. However, this could prevent remotely managed hosts from being started. With this update, the boot process is no longer denied by default; only guest creation is denied. The allow_unsafe semantics has changed to allow creation of guests instead of allowing booting the host.
Clone Of:
Environment:
Last Closed: 2013-01-08 04:43:19 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2013:0006 0 normal SHIPPED_LIVE Red Hat Enterprise Linux 5.9 kernel update 2013-01-08 08:48:56 UTC

Description Petr Matousek 2012-09-19 13:55:11 UTC 
Description of problem:

The default behaviour of CVE-2012-2934 is to prevent the host from booting when AMD processor with erratum #121 is detected. This might prevent the remotely managed host to be started.

Instead of boot denial just deny guest creation by default. allow_unsafe(=on) behaviour is preserved.

Upstream commit:
http://xenbits.xensource.com/hg/xen-unstable.hg/rev/e6ca45ca03c2

References:
https://bugzilla.redhat.com/show_bug.cgi?id=824966#c19
Comment 4 RHEL Program Management 2012-09-20 09:10:28 UTC 
This request was evaluated by Red Hat Product Management for
inclusion in a Red Hat Enterprise Linux release.  Product
Management has requested further review of this request by
Red Hat Engineering, for potential inclusion in a Red Hat
Enterprise Linux release for currently deployed products.
This request is not yet committed for inclusion in a release.
Comment 7 Phillip Lougher 2012-09-26 17:01:11 UTC 
Patch(es) available in kernel-2.6.18-341.el5
You can download this test kernel (or newer) from http://people.redhat.com/plougher/el5/
Detailed testing feedback is always welcomed.
If you require guidance regarding testing, please ask the bug assignee.
Comment 9 Wei Shi 2012-10-19 10:00:33 UTC 
reproduce:
----------
HOST:2.6.18-340.el5xen
Guest:2.6.32-267.el6.bz813428.x86_64

can't boot the dom0 on AMD Opteron(tm) Processor 246

append hypervisor parameter
kernel /xen.gz-2.6.18-340.el5 allow_unsafe=on

dom0 could launch up successfully, and we could create domU.


verified:
---------
HOST:2.6.18-341.el5xen
Guest:2.6.32-267.el6.bz813428.x86_64

# xm cr xm-test.conf 
Using config file "./xm-test.conf".
Using <class 'grub.GrubConf.GrubConfigFile'> to parse /grub/menu.lst
Error: (12, 'Cannot allocate memory')

dom0 could boot up without allow_unsafe parameter but we can't create any domU.
Comment 10 Wei Shi 2012-10-22 02:57:27 UTC 
(In reply to comment #9)
> reproduce:
> ----------
> HOST:2.6.18-340.el5xen
> Guest:2.6.32-267.el6.bz813428.x86_64
> 
> can't boot the dom0 on AMD Opteron(tm) Processor 246
> 
> append hypervisor parameter
> kernel /xen.gz-2.6.18-340.el5 allow_unsafe=on
> 
> dom0 could launch up successfully, and we could create domU.
> 
> 
> verified:
> ---------
> HOST:2.6.18-341.el5xen
> Guest:2.6.32-267.el6.bz813428.x86_64
> 
> # xm cr xm-test.conf 
> Using config file "./xm-test.conf".
> Using <class 'grub.GrubConf.GrubConfigFile'> to parse /grub/menu.lst
> Error: (12, 'Cannot allocate memory')
> 
> dom0 could boot up without allow_unsafe parameter but we can't create any
> domU.

With the latest kernel:

HOST:2.6.18-344.el5xen
Guest:2.6.32-267.el6.bz813428.x86_64

# xm cr xm-test.conf 
Using config file "./xm-test.conf".
Using <class 'grub.GrubConf.GrubConfigFile'> to parse /grub/menu.lst
Error: (12, 'Cannot allocate memory')
Comment 12 errata-xmlrpc 2013-01-08 04:43:19 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2013-0006.html
Note You need to log in before you can comment on or make changes to this bug.