Bug 1590984 (CVE-2018-12892) - CVE-2018-12892 xsa-266 xen: libxl fails to honour readonly flag on HVM emulated SCSI disks
Summary: CVE-2018-12892 xsa-266 xen: libxl fails to honour readonly flag on HVM emulat...
Alias: CVE-2018-12892
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
Depends On: 1595957
Blocks: 1590986
TreeView+ depends on / blocked
Reported: 2018-06-13 20:48 UTC by Pedro Sampaio
Modified: 2021-02-17 00:08 UTC (History)
13 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Last Closed: 2018-06-28 08:46:59 UTC

Attachments (Terms of Use)

Description Pedro Sampaio 2018-06-13 20:48:10 UTC
Xen Security Advisory XSA-266

libxl fails to honour readonly flag on HVM emulated SCSI disks

*** EMBARGOED UNTIL 2018-06-27 21:00 UTC ***


libxl fails to pass the readonly flag to qemu when setting up a SCSI
disk, due to what was probably an erroneous merge conflict resolution.


Malicious guest administrators or (in some situations) users may be
able to write to supposedly read-only disk images.


Only emulated SCSI disks (specified as "sd" in the libxl disk
configuration, or an equivalent) are affected. IDE disks ("hd") are
not affected (because attempts to make them readonly are rejected).

Additionally, CDROM devices (that is, devices specified to be
presented to the guest as CDROMs, regardless of the nature of the
backing storage on the host) are not affected; they are always

Only systems using qemu-xen (rather than qemu-xen-traditional) as the
device model version are vulnerable.

Only systems using libxl or libxl-based toolstacks are vulnerable.
(This includes xl, and libvirt with the libxl driver.)

The vulnerability is present in Xen versions 4.7 and later.
(In earlier versions, provided that the patch for XSA-142 has been
applied, attempts to create readonly disks are rejected.)

If the host and guest together usually support PVHVM, the issue is
exploitable only if the malicious guest administrator has control of
the guest kernel or guest kernel command line.


Switching to qemu-xen-traditional will avoid this vulnerability.
This can be done with
in the xl configuration file.

Using stub domain device models (which necessarily involves switching
to qemu-xen-traditional) will also avoid this vulnerability.
This can be done with
in the xl configuration file.

All of these mitigations are liable to have other guest-visible
effects or even regressions.

It may be possible, depending on the configuration, to make the
underlying storage object readonly, or to make it reject writes.

Comment 1 Pedro Sampaio 2018-06-13 20:48:16 UTC

Name: the Xen project

Comment 2 Laura Pardo 2018-06-27 22:06:30 UTC
Created xen tracking bugs for this issue:

Affects: fedora-all [bug 1595957]

Note You need to log in before you can comment on or make changes to this bug.