Bug 1370319 (CVE-2016-7092, xsa185) - CVE-2016-7092 xen: x86: Disallow L3 recursive pagetable for 32-bit PV guests
Summary: CVE-2016-7092 xen: x86: Disallow L3 recursive pagetable for 32-bit PV guests
Keywords:
Status: CLOSED WONTFIX
Alias: CVE-2016-7092, xsa185
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1374470
Blocks:
TreeView+ depends on / blocked
 
Reported: 2016-08-26 00:21 UTC by Jeremy Choi
Modified: 2021-02-17 03:25 UTC (History)
2 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2016-09-08 18:38:49 UTC


Attachments (Terms of Use)
xsa185.patch xen-unstable - Xen 4.4 (1.16 KB, application/mbox)
2016-08-26 00:24 UTC, Jeremy Choi
no flags Details

Description Jeremy Choi 2016-08-26 00:21:11 UTC
ISSUE DESCRIPTION
=================

On real hardware, a 32-bit PAE guest must leave the USER and RW bit
clear in L3 pagetable entries, but the pagetable walk behaves as if
they were set. (The L3 entries are cached in processor registers, and
don't actually form part of the pagewalk.)

When running a 32-bit PV guest on a 64-bit Xen, Xen must always OR in
the USER and RW bits for L3 updates for the guest to observe
architectural behaviour. This is unsafe in combination with recursive
pagetables.

As there is no way to construct an L3 recursive pagetable in native
32-bit PAE mode, disallow this option in 32-bit PV guests.

IMPACT
======

A malicious 32-bit PV guest administrator can escalate their privilege
to that of the host.

VULNERABLE SYSTEMS
==================

All versions of Xen are vulnerable.

Only 64-bit builds of the hypervisor are vulnerable. For Xen 4.3 and
earlier, 32-bit builds of the hypervisor are not vulnerable.

The vulnerability is only exposed to 32-bit PV guests on x86 hardware.

The vulnerability is not exposed to 64-bit PV guests, x86 HVM guests,
or ARM guests.

MITIGATION
==========

Running only 64-bit PV or HVM guests will avoid this vulnerability.

RESOLUTION
==========

Applying the attached patch resolves this issue.

xsa185.patch xen-unstable - Xen 4.4

$ sha256sum xsa185*
7d3d3b47cff671d3772fdbaeae88f2336e0033a772dbe3da5e91bc4ed64c1bda xsa185.patch
$

Comment 1 Jeremy Choi 2016-08-26 00:24:32 UTC
Created attachment 1194156 [details]
xsa185.patch xen-unstable - Xen 4.4

Comment 2 Andrej Nemec 2016-08-26 10:48:26 UTC
Xen Security Advisory CVE-2016-7092 / XSA-185
version 2

UPDATES IN VERSION 2
====================

CVE assigned.

Comment 3 Martin Prpič 2016-09-08 18:38:01 UTC
Created xen tracking bugs for this issue:

Affects: fedora-all [bug 1374470]

Comment 4 Martin Prpič 2016-09-08 18:38:49 UTC
External References:

https://xenbits.xen.org/xsa/advisory-185.html

Comment 5 Martin Prpič 2016-09-08 19:04:59 UTC
Acknowledgements:

Name: the Xen project
Upstream: Jérémie Boutoille (Quarkslab), Shangcong Luan (Alibaba Cloud)

Comment 6 Fedora Update System 2016-09-13 22:21:47 UTC
xen-4.6.3-5.fc24 has been pushed to the Fedora 24 stable repository. If problems still persist, please make note of it in this bug report.

Comment 7 Fedora Update System 2016-09-14 15:55:41 UTC
xen-4.7.0-5.fc25 has been pushed to the Fedora 25 stable repository. If problems still persist, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.