Bug 950668 (CVE-2013-1917) - CVE-2013-1917 kernel: xen: Xen PV DoS vulnerability with SYSENTER
Summary: CVE-2013-1917 kernel: xen: Xen PV DoS vulnerability with SYSENTER
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2013-1917
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 953569
Blocks: 950673
TreeView+ depends on / blocked
 
Reported: 2013-04-10 15:34 UTC by Petr Matousek
Modified: 2023-05-11 22:27 UTC (History)
6 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2013-05-13 08:01:43 UTC
Embargoed:

Attachments (Terms of Use)

Description Petr Matousek 2013-04-10 15:34:23 UTC 
The SYSENTER instruction can be used by PV guests to accelerate system call processing. This instruction, however, leaves the EFLAGS register mostly unmodified - in particular, the NT flag doesn't get cleared. If the hypervisor subsequently uses IRET to return to the guest (which it will always do if the guest is a 32-bit one), that instruction will cause a #GP fault to be raised, but the recovery code in the hypervisor will again try to use IRET without intermediately clearing the NT flag. The #GP fault raised on this second IRET is a fatal event, causing the hypervisor to crash.

Malicious or buggy unprivileged user space can cause the entire host to crash.

The vulnerability is only exposed by 64-bit PV guests running on Intel CPUs.

Acknowledgements:

Red Hat would like to thank the Xen for reporting this issue.
Comment 1 Petr Matousek 2013-04-10 15:37:22 UTC 
Statement:

Not vulnerable.

This issue did not affect the versions of the kernel-xen package as shipped with Red Hat Enterprise Linux 5 as we did not have support for sysenter for 64bit PV guests running on the Xen hypervisor (introduced in upstream changeset 16207:aeebd173c3fa).

This issue did not affect the versions of the Linux kernel as shipped with Red Hat Enterprise Linux 6 and Red Hat Enterprise MRG as we did not have support for Xen hypervisor.
Comment 3 Petr Matousek 2013-04-18 13:44:44 UTC 
Created xen tracking bugs for this issue

Affects: fedora-all [bug 953569]
Comment 4 Fedora Update System 2013-05-05 02:25:11 UTC 
xen-4.1.5-1.fc17 has been pushed to the Fedora 17 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 5 Fedora Update System 2013-05-05 02:25:48 UTC 
xen-4.2.2-1.fc18 has been pushed to the Fedora 18 stable repository.  If problems still persist, please make note of it in this bug report.
Note You need to log in before you can comment on or make changes to this bug.