Bug 524200 – <app-emulation/xen-{4.2.5-r1,4.3.3-r1}: Improper MSR range used for x2APIC emulation (XSA-108) (CVE-2014-7188)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Tobias Heinlein (RETIRED) 2014-10-01 12:10:29 UTC]

See $URL.

[Comment 1 Chicago 2014-10-01 16:53:35 UTC]

Also, of note -- Gentoo is absent from the pre-disclosure list.
http://www.xenproject.org/security-policy.html

    We should work to have ourselves included in order to patch Gentoo Infrastructure early and be ready to release patched ebuilds immediately after CVEs are disclosed to the public.

[Comment 2 Yixun Lan 2014-10-10 03:21:58 UTC]

+*xen-4.4.1-r2 (10 Oct 2014)
+*xen-4.3.3-r1 (10 Oct 2014)
+*xen-4.2.5-r1 (10 Oct 2014)
+
+  10 Oct 2014; Yixun Lan <[e-mail]> +xen-4.2.5-r1.ebuild,
+  +xen-4.3.3-r1.ebuild, -xen-4.4.1-r1.ebuild, +xen-4.4.1-r2.ebuild:
+  revision bump, fix security bug 524200, 523524


Arches, please test and mark stable:
=app-emulation/xen-4.2.5-r1
=app-emulation/xen-tools-4.2.5-r1
=app-emulation/xen-pvgrub-4.2.4
Target keywords Both : "amd64 x86"

=app-emulation/xen-4.3.3-r1
=app-emulation/xen-tools-4.3.3-r1
=app-emulation/xen-pvgrub-4.3.3
Target keywords Only: "amd64"

(note, those security bugs only relevant to app-emulation/xen
but we'd like to stablereq xen ebuild in one request, so combine them all here
and changes to xen-tools are quite trivial, xen-pvgrub in tree quite long)

[Comment 3 Yixun Lan 2014-10-10 03:24:23 UTC]

sorry, should stabilize =app-emulation/xen-pvgrub-4.2.5, not (4.2.4)

[Comment 4 Tobias Heinlein (RETIRED) 2014-10-13 21:56:20 UTC]

You forgot to CC the arch teams. :)

[Comment 5 Agostino Sarubbo 2014-10-14 13:15:13 UTC]

amd64 stable

[Comment 6 Agostino Sarubbo 2014-10-14 13:15:52 UTC]

x86 stable.

Maintainer(s), please cleanup.
Security, please add it to the existing request, or file a new one.

[Comment 7 GLSAMaker/CVETool Bot 2014-10-15 01:26:44 UTC]

CVE-2014-7188 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-7188):
  The hvm_msr_read_intercept function in arch/x86/hvm/hvm.c in Xen 4.1 through
  4.4.x uses an improper MSR range for x2APIC emulation, which allows local
  HVM guests to cause a denial of service (host crash) or read data from the
  hypervisor or other guests via unspecified vectors.

[Comment 8 Yury German 2014-10-15 01:28:10 UTC]

Arches, Thank you for your work
Maintainer(s), please drop the vulnerable version(s).

New GLSA Request filed.

[Comment 9 Yixun Lan 2014-10-15 01:44:24 UTC]

thanks, old version has been dropped.

[Comment 10 Yury German 2014-10-15 03:34:08 UTC]

Maintainer(s), Thank you for cleanup!

[Comment 11 GLSAMaker/CVETool Bot 2014-12-26 18:40:55 UTC]

This issue was resolved and addressed in
 GLSA 201412-42 at http://security.gentoo.org/glsa/glsa-201412-42.xml
by GLSA coordinator Yury German (BlueKnight).