oss-sec mailing list archives
Re: Xen Security Advisory 99 - unexpected pitfall in xenaccess API
From: Steven Haigh <netwiz () crc id au>
Date: Tue, 17 Jun 2014 23:24:52 +1000
On 17/06/14 23:13, Andres Lagar Cavilla wrote:
Xen Security Advisory XSA-99 version 2 unexpected pitfall in xenaccess API UPDATES IN VERSION 2 ==================== Public Release. Added note regarding CVE. ISSUE DESCRIPTION ================= A test/example program, for exercising the Xen memaccess API, does not take all necessary precautions against hostile guest behaviour. As a result, software developers using it as an example or template might have written and deployed vulnerable code.How?I've looked at the patch. It's the refactor proposed in a separate thread by Dushyant Behl, lifted up a level. Obviously useful, +2.But fundamentally, how is this a vulnerability? Since the dawn of time guests can poke at the qemu and PV frontend rings. So self DoS, check. But, privilege escalation?Is this predicated on the potential (lack of) software quality of the xenaccess backends? That's a fair argument, but a different story.I am puzzled how this is an XSA that addresses "privilege escalation".
Also note: [netwiz@dev xen-4.2.4]$ patch -p1 < ../xsa-99.patch patching file tools/libxc/xc_mem_access.c Hunk #1 succeeded at 24 with fuzz 2. patching file tools/libxc/xc_mem_event.c patching file tools/libxc/xenctrl.h Hunk #1 succeeded at 1907 (offset -116 lines). Hunk #2 succeeded at 1933 with fuzz 2 (offset -116 lines). patching file tools/tests/xen-access/xen-access.c Hunk #1 succeeded at 233 (offset 10 lines). Hunk #2 succeeded at 254 (offset 10 lines). Hunk #3 succeeded at 269 (offset 10 lines). Hunk #4 FAILED at 293. 1 out of 4 hunks FAILED -- saving rejects to file tools/tests/xen-access/xen-access.c.rej In a nutshell, it doesn't apply cleanly either... -- Steven Haigh Email: netwiz () crc id au Web: http://www.crc.id.au Phone: (03) 9001 6090 - 0412 935 897 Fax: (03) 8338 0299
Attachment:
signature.asc
Description: OpenPGP digital signature
Current thread:
- Xen Security Advisory 99 - unexpected pitfall in xenaccess API Xen . org security team (Jun 17)
- <Possible follow-ups>
- Xen Security Advisory 99 - unexpected pitfall in xenaccess API Andres Lagar Cavilla (Jun 17)
- Re: Xen Security Advisory 99 - unexpected pitfall in xenaccess API Ian Campbell (Jun 17)
- Re: Xen Security Advisory 99 - unexpected pitfall in xenaccess API Andres Lagar Cavilla (Jun 17)
- Re: Xen Security Advisory 99 - unexpected pitfall in xenaccess API Steven Haigh (Jun 17)
- Re: Xen Security Advisory 99 - unexpected pitfall in xenaccess API Ian Campbell (Jun 17)