Xen Security Advisory CVE-2016-3158,CVE-2016-3159 / XSA-172 version 3 broken AMD FPU FIP/FDP/FOP leak workaround UPDATES IN VERSION 3 ==================== Public release. ISSUE DESCRIPTION ================= There is a workaround in Xen to deal with the fact that AMD CPUs don't load the x86 registers FIP (and possibly FCS), FDP (and possibly FDS), and FOP from memory (via XRSTOR or FXRSTOR) when there is no pending unmasked exception. (See XSA-52.) However, this workaround does not cover all possible input cases. This is because writes to the hardware FSW.ES bit, which the current workaround is based on, are ignored; instead, the CPU calculates FSW.ES from the pending exception and exception mask bits. Xen therefore needs to do the same. Note that part of said workaround was the subject of XSA-52. This can leak register contents from one guest to another. The registers in question are the FPU instruction and data pointers and opcode. IMPACT ====== A malicious domain is able to obtain address space usage and timing information, about another domain, at a fairly low rate. The leaked address information might be used to help defeat address space randomisation in order to enable another attack. The leaked address and timing information forms a low-bandwidth covert channel which might be used to gain information about the operation of a target guest. The affected FPU facility would not normally be used by cryptographic operations, as it does not provide cryptographically-relevant SIMD functions. It appears to us very unlikely that the leak might directly compromise sensitive information such as cryptographic keys, although (without knowledge of the guest software) this cannot be ruled out. (This is notwithstanding the contrary statement in `Impact' in XSA-52.) VULNERABLE SYSTEMS ================== Xen versions 4.0 and onwards are vulnerable. Any kind of guest can exploit the vulnerability. The vulnerability is exposed only on AMD x86 systems. Intel and ARM systems do not expose this vulnerability. Both PV and HVM guests are affected. MITIGATION ========== The vulnerability can be avoided if the guest kernel is controlled by the host rather than guest administrator, provided that further steps are taken to prevent the guest administrator from loading code into the kernel (e.g. by disabling loadable modules etc) or from using other mechanisms which allow them to run code at kernel privilege. On Xen versions 4.3 and earlier, turning off XSAVE support via the "no-xsave" hypervisor command line option will avoid the vulnerability. On Xen versions 4.4 and onwards there is no other known mitigation. CREDITS ======= This issue was discovered by Jan Beulich from SUSE. RESOLUTION ========== Applying the appropriate attached patch resolves this issue. xsa172.patch xen-unstable, Xen 4.6.x, Xen 4.5.x, Xen 4.4.x xsa172-4.3.patch Xen 4.3.x $ sha256sum xsa172* f18282fcb794b8772bc3af51d56860050071bd62a5a909b8f2fc2018e2958154 xsa172.patch 6aac179620afcdbdab041163239019bc35b0e243f3bd16673caaec7d5a4d97ec xsa172-4.3.patch $ NOTE REGARDING CVE ================== CVE-2016-3158 is for the code change which is required for all versions (but which is sufficient only on Xen 4.3.x, and insufficient on later versions). Ie for the second hunk in xsa172.patch (the only hunk in xsa172-4.3.patch), which patches the function xrstor. CVE-2016-3159 is for the code change which is applicable for later versions only, but which must always be combined with the code change for CVE-2016-3158. Ie for the first hunk in xsa172.patch, which patches the function fpu_fxrstor.
commit 70be44e9eb6b0c1dd98234059f8d9cefb25b29dc Author: Ian Delaney <idella4@gentoo.org> Date: Sat Apr 23 18:03:54 2016 +0800 app-emulation/xen: revbumps subsequent to addition of xsa sec patches versions; 4.5.2-r6 4.6.0-r10 4.6.1-r1 sec patches; xsa 172 173 Gentoo-bug: #579074 #579072 commit 90911e349565fc34ba172e2622e2ec29650844be Author: Ian Delaney <idella4@gentoo.org> Date: Sat Apr 23 17:57:23 2016 +0800 app-emulation/xen-tools: revbumps subsequent to addition of xsa sec patches versions; 4.5.2-r6 4.6.0-r10 4.6.1-r1 sec patches; xsa 172 173 Gentoo-bug: #579074 #579072
Xen is not vulnerable, xen-tools has x86 version stable, waiting for 30 days to go stable.
Version 4.6.3-r1 : 0 was fixed in bug 588780. Setting dependency for GLSA This is only for the app-emulation/xen-tools
No GLSA to be filed
