Bug 1392929 (CVE-2016-9385, xsa193) - CVE-2016-9385 xsa193 xen: x86 segment base write emulation lacking canonical address checks (XSA-193)
Summary: CVE-2016-9385 xsa193 xen: x86 segment base write emulation lacking canonical ...
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2016-9385, xsa193
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1397383
Blocks: 1392955
TreeView+ depends on / blocked
 
Reported: 2016-11-08 13:55 UTC by Adam Mariš
Modified: 2021-02-17 03:04 UTC (History)
1 user (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2018-03-07 10:20:56 UTC


Attachments (Terms of Use)
Xen 4.5.x, Xen 4.4.x (2.76 KB, patch)
2016-11-08 14:46 UTC, Adam Mariš
no flags Details | Diff
Xen 4.7.x, Xen 4.6.x (2.84 KB, patch)
2016-11-08 14:46 UTC, Adam Mariš
no flags Details | Diff
xen-unstable (2.68 KB, patch)
2016-11-08 14:46 UTC, Adam Mariš
no flags Details | Diff

Description Adam Mariš 2016-11-08 13:55:09 UTC
ISSUE DESCRIPTION
=================

Both writes to the FS and GS register base MSRs as well as the
WRFSBASE and WRGSBASE instructions require their input values to be
canonical, or a #GP fault will be raised.  When the use of those
instructions by the hypervisor was enabled, the previous guard against
#GP faults (having recovery code attached) was accidentally removed.

IMPACT
======

A malicious guest administrator can crash the host, leading to a DoS.

VULNERABLE SYSTEMS
==================

Xen versions 4.4 and onwards are affected.  Xen versions 4.3 and
earlier are not affected.

The vulnerability is only exposed to x86 PV guests.

The vulnerability is NOT exposed to x86 HVM guests.

ARM systems are NOT vulnerable.

MITIGATION
==========

Running only HVM guests will avoid this vulnerability.

For PV guests the vulnerability can be avoided if the guest kernel is
controlled by the host rather than guest administrator, provided that
further steps are taken to prevent the guest administrator from loading
code into the kernel (e.g. by disabling loadable modules etc) or from
using other mechanisms which allow them to run code at kernel privilege.

External References:

http://xenbits.xen.org/xsa/advisory-193.html

Acknowledgements:

Name: the Xen project
Upstream: Andrew Cooper (Citrix)

Comment 1 Adam Mariš 2016-11-08 14:46:05 UTC
Created attachment 1218547 [details]
Xen 4.5.x, Xen 4.4.x

Comment 2 Adam Mariš 2016-11-08 14:46:33 UTC
Created attachment 1218548 [details]
Xen 4.7.x, Xen 4.6.x

Comment 3 Adam Mariš 2016-11-08 14:46:52 UTC
Created attachment 1218549 [details]
xen-unstable

Comment 4 Martin Prpič 2016-11-22 12:25:14 UTC
Created xen tracking bugs for this issue:

Affects: fedora-all [bug 1397383]


Note You need to log in before you can comment on or make changes to this bug.