Bug 986295 - (CVE-2013-2212) CVE-2013-2212 kernel: xen: Excessive time to disable caching with HVM guests with PCI passthrough
CVE-2013-2212 kernel: xen: Excessive time to disable caching with HVM guests ...
Status: CLOSED NOTABUG
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
medium Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
impact=moderate,public=20130724,repor...
: Security
Depends On: 987914
Blocks: 986297
  Show dependency treegraph
 
Reported: 2013-07-19 06:54 EDT by Petr Matousek
Modified: 2013-07-24 12:19 EDT (History)
5 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2013-07-24 08:11:00 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Petr Matousek 2013-07-19 06:54:12 EDT
HVM guests are able to manipulate their physical address space such that
processing a subsequent request by that guest to disable caches takes an
extended amount of time changing the cachability of the memory pages assigned
to this guest. This applies only when the guest has been granted access to
some memory mapped I/O region (typically by way of assigning a passthrough
PCI device).

This can cause the CPU which processes the request to become unavailable,
possibly causing the hypervisor or a guest kernel (including the domain 0 one)
to halt itself ("panic").

A malicious domain, given access to a device with memory mapped I/O
regions, can cause the host to become unresponsive for a period of
time, potentially leading to a DoS affecting the whole system.

Only systems using the Intel variant of Hardware Assisted Paging (aka EPT) are
vulnerable.

Acknowledgements:

Red Hat would like to thank the Xen for reporting this issue. Upstream acknowledges Zhenzhong Duan as the original reporter.
Comment 2 Petr Matousek 2013-07-19 07:01:36 EDT
Statement:

Not vulnerable.

This issue did not affect the versions of the kernel-xen package as shipped with Red Hat Enterprise Linux 5.

This issue did not affect the versions of the Linux kernel as shipped with Red Hat Enterprise Linux 6 and Red Hat Enterprise MRG as we did not have support for Xen hypervisor.
Comment 4 Petr Matousek 2013-07-24 08:11:00 EDT
Now public via:

http://seclists.org/oss-sec/2013/q3/182
Comment 5 Petr Matousek 2013-07-24 08:12:08 EDT
Created xen tracking bugs for this issue:

Affects: fedora-all [bug 987914]

Note You need to log in before you can comment on or make changes to this bug.