Xen Security Advisory CVE-2015-7504 / XSA-162 heap buffer overflow vulnerability in pcnet emulator *** EMBARGOED UNTIL 2015-11-30 06:00 UTC *** ISSUE DESCRIPTION ================= The QEMU security team has predisclosed the following advisory: The AMD PC-Net II emulator(hw/net/pcnet.c), while receiving packets in loopback mode, appends CRC code to the receive buffer. If the data size given is same as the buffer size(4096), the appended CRC code overwrites 4 bytes after the s->buffer, making the adjacent 's->irq' object point to a new location. IMPACT ====== A guest which has access to an emulated PCNET network device (e.g. with "model=pcnet" in their VIF configuration) can exploit this vulnerability to take over the qemu process elevating its privilege to that of the qemu process. VULNERABLE SYSTEMS ================== All Xen systems running x86 HVM guests without stubdomains which have been configured to use the PCNET emulated driver model are vulnerable. The default configuration is NOT vulnerable (because it does not emulate PCNET NICs). Systems running only PV guests are NOT vulnerable. Systems using qemu-dm stubdomain device models (for example, by specifying "device_model_stubdomain_override=1" in xl's domain configuration files) are NOT vulnerable. Both the traditional "qemu-xen" or upstream qemu device models are potentially vulnerable. ARM systems are NOT vulnerable. MITIGATION ========== Avoiding the use of emulated network devices altogether, by specifying a PV only VIF in the domain configuration file will avoid this issue. Avoiding the use of the PCNET device in favour of other emulations will also avoid this issue. Enabling stubdomains will mitigate this issue, by reducing the escalation to only those privileges accorded to the service domain. qemu-dm stubdomains are only available with the traditional "qemu-xen" version. RESOLUTION ========== The QEMU security team have supplied the attached xsa162-qemuu.patch which it is believed will resolve the issue. However this patch has not undergone the usual reviews and has not yet been accepted by QEMU upstream. The backports were created by the Xen Project security team on the same basis. xsa162-qemuu.patch qemu upstream, Xen unstable, 4.6.x, 4.5.x, 4.4.x xsa162-qemuu-4.3.patch Xen 4.3.x xsa162-qemut-4.3.patch qemu-xen-traditional, Xen unstable, 4.5.x, 4.4.x, 4.3.x $ sha256sum xsa162* d823155dcc1f93098a54f295a488eb2e3d5636f00f9b229eafc7536311f8065c xsa162-qemut.patch 90d9f0aa2c813fcb116095545f2b8e7b4240d65d5038e655ee1f184d6160493c xsa162-qemuu.patch 7b423994e86cddd90dd53026e1e95b713580dbc12ef7f18d1bb73a2e165ad4b8 xsa162-qemuu-4.3.patch $ CREDITS ======= This issue was discovered by the Qihoo 360 Marvel Team.
Patches have been sent to developer as per agreement with xen maintainers.
UPDATES IN VERSION 2 ==================== Public release. Correct cut and paste reference to bootloaders in "DEPLOYMENT DURING EMBARGO" section, which should have instead referred to the configuration changes.
commit 67f629f0a52e81af499dc1cb5ed4a9dc79af791e Author: Ian Delaney <idella4@gentoo.org> Date: Tue Dec 1 00:00:33 2015 +0800 app-emulation/xen-tools: revbumps vns. 4.5.2-r1, 4.6.0-r3 security patches (2) added from XSA-162, initally set as embargoed security patches, publicly released today wrt the gentoo bug Gentoo bug: #566838
amd64 stable. Maintainer(s), please cleanup. Security, please vote.
Added to an existing GLSA Request. Maintainer(s), please drop the vulnerable version(s).
Actually this pair of patches pertain only to xen-tools, not to package xen. Patches added to xen-tools-4.5.2-r1.ebuild & xen-tools-4.6.0-r3.ebuild making xen-tools-4.5.2.ebuild, xen-tools-4.6.0-r2.ebuild the vulnerable versions. commit 2e385225eec30f5fbb7703c01cd862653e07143d Author: Ian Delaney <idella4@gentoo.org> Date: Thu Dec 3 21:53:32 2015 +0800 app-emulation/xen-tools: clean vulnerable versions wrt security bug #566838 Gentoo bug : #566838
Arches and Maintainer(s), Thank you for your work.
This issue was resolved and addressed in GLSA 201604-03 at https://security.gentoo.org/glsa/201604-03 by GLSA coordinator Yury German (BlueKnight).
