Bug 1392933 (CVE-2016-9382, xsa192) - CVE-2016-9382 xsa192 xen: x86 task switch to VM86 mode mis-handled (XSA-192)
Summary: CVE-2016-9382 xsa192 xen: x86 task switch to VM86 mode mis-handled (XSA-192)
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2016-9382, xsa192
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1397383
Blocks: 1392955
TreeView+ depends on / blocked
 
Reported: 2016-11-08 13:56 UTC by Adam Mariš
Modified: 2021-02-17 03:04 UTC (History)
1 user (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2018-03-07 10:20:26 UTC


Attachments (Terms of Use)
xen-unstable, Xen 4.7.x, Xen 4.6.x (2.28 KB, patch)
2016-11-08 14:38 UTC, Adam Mariš
no flags Details | Diff
Xen 4.5.x, Xen 4.4.x (2.26 KB, patch)
2016-11-08 14:38 UTC, Adam Mariš
no flags Details | Diff

Description Adam Mariš 2016-11-08 13:56:07 UTC
ISSUE DESCRIPTION
=================

LDTR, just like TR, is purely a protected mode facility.  Hence even
when switching to a VM86 mode task, LDTR loading needs to follow
protected mode semantics.  This was violated by the code.

IMPACT
======

On SVM (AMD hardware): a malicious unprivileged guest process can
escalate its privilege to that of the guest operating system.

On both SVM and VMX (Intel hardware): a malicious unprivileged guest
process can crash the guest.

VULNERABLE SYSTEMS
==================

Only 32-bit x86 HVM guests are vulnerable.  Furthermore, only guest
operating systems which actually make use of hardware task switching,
and allow a new task to start in VM86 mode, are vulnerable.  We are
not aware of any such operating systems.

The vulnerability is NOT exposed on any PV guests.
The vulnerability is NOT exposed on any 64-bit guests,

ARM systems are NOT vulnerable.

Xen versions from 4.0 onwards are affected.  Xen versions 3.4 and
earlier are not affected.

MITIGATION
==========

For guests which are affected, the vulnerability could possibly be
mitigated by disabling access to VM86 mode by unprivileged guest
programs.  Details would depend on the (so far hypothetical)
vulnerable guest kernel.

External References:

http://xenbits.xen.org/xsa/advisory-192.html

Acknowledgements:

Name: the Xen project
Upstream: Jan Beulich (SUSE)

Comment 1 Adam Mariš 2016-11-08 14:38:17 UTC
Created attachment 1218532 [details]
xen-unstable, Xen 4.7.x, Xen 4.6.x

Comment 2 Adam Mariš 2016-11-08 14:38:42 UTC
Created attachment 1218533 [details]
Xen 4.5.x, Xen 4.4.x

Comment 3 Martin Prpič 2016-11-22 12:25:05 UTC
Created xen tracking bugs for this issue:

Affects: fedora-all [bug 1397383]


Note You need to log in before you can comment on or make changes to this bug.