Bug 950668 - (CVE-2013-1917) CVE-2013-1917 kernel: xen: Xen PV DoS vulnerability with SYSENTER
CVE-2013-1917 kernel: xen: Xen PV DoS vulnerability with SYSENTER
Status: CLOSED NOTABUG
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
high Severity high
: ---
: ---
Assigned To: Red Hat Product Security
impact=important,public=20130418,repo...
: Security
Depends On: 953569
Blocks: 950673
  Show dependency treegraph
 
Reported: 2013-04-10 11:34 EDT by Petr Matousek
Modified: 2013-05-13 04:01 EDT (History)
6 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2013-05-13 04:01:43 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:


Attachments (Terms of Use)

  None (edit)
Description Petr Matousek 2013-04-10 11:34:23 EDT
The SYSENTER instruction can be used by PV guests to accelerate system call processing. This instruction, however, leaves the EFLAGS register mostly unmodified - in particular, the NT flag doesn't get cleared. If the hypervisor subsequently uses IRET to return to the guest (which it will always do if the guest is a 32-bit one), that instruction will cause a #GP fault to be raised, but the recovery code in the hypervisor will again try to use IRET without intermediately clearing the NT flag. The #GP fault raised on this second IRET is a fatal event, causing the hypervisor to crash.

Malicious or buggy unprivileged user space can cause the entire host to crash.

The vulnerability is only exposed by 64-bit PV guests running on Intel CPUs.

Acknowledgements:

Red Hat would like to thank the Xen for reporting this issue.
Comment 1 Petr Matousek 2013-04-10 11:37:22 EDT
Statement:

Not vulnerable.

This issue did not affect the versions of the kernel-xen package as shipped with Red Hat Enterprise Linux 5 as we did not have support for sysenter for 64bit PV guests running on the Xen hypervisor (introduced in upstream changeset 16207:aeebd173c3fa).

This issue did not affect the versions of the Linux kernel as shipped with Red Hat Enterprise Linux 6 and Red Hat Enterprise MRG as we did not have support for Xen hypervisor.
Comment 3 Petr Matousek 2013-04-18 09:44:44 EDT
Created xen tracking bugs for this issue

Affects: fedora-all [bug 953569]
Comment 4 Fedora Update System 2013-05-04 22:25:11 EDT
xen-4.1.5-1.fc17 has been pushed to the Fedora 17 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 5 Fedora Update System 2013-05-04 22:25:48 EDT
xen-4.2.2-1.fc18 has been pushed to the Fedora 18 stable repository.  If problems still persist, please make note of it in this bug report.

Note You need to log in before you can comment on or make changes to this bug.