Xen Security Advisory XSA-178 Unsanitised driver domain input in libxl device handling *** EMBARGOED UNTIL 2016-06-02 12:00 UTC *** ISSUE DESCRIPTION ================= libxl's device-handling code freely uses and trusts information from the backend directories in xenstore. The backend domain (driver domain) can store bogus data in the backend, causing libxl's enquiry functions to fail, confusing management tools. A driver domain can also remove its backend directory from xenstore entirely, preventing the device from showing up in device listings and preventing it from being removed and replaced. A driver domain can cause libxl to generate disk eject events for disks for which the driver domain is not responsible. IMPACT ====== A malicious driver domain can deny service to management tools. VULNERABLE SYSTEMS ================== This vulnerability is only applicable to systems which are using driver domains, and then only where the driver domain is not intended to be fully trusted with respect to the host. Such Xen systems using libxl based toolstacks (for example xl or libvirt with the libxl driver) are vulnerable. Note that even with this vulnerability a driver domain based system is better from a security point of view, than a system where devices are provided directly by dom0. Users and vendors of systems using driver domains should not change their configuration. MITIGATION ========== No mitigation is available. RESOLUTION ========== Applying the appropriate attached patch set from XSA-175, plus the appropriate attached patch set below, resolves this issue. xsa178-unstable/*.patch xen-unstable $ sha256sum xsa178-*/* fd6a1f858d44f618a4e792553598005871f63d12e718bc9b5477d14bf0113386 xsa178-unstable/0001-libxl-Make-copy-of-every-xs-backend-in-libxl-in-_gen.patch ee6cf66ad385203c49d9b030959715fb885a250aa36b85080e6985a603bb1ddb xsa178-unstable/0002-libxl-Do-not-trust-backend-in-libxl__device_exists.patch ea29cf28609c2d467fb7a620601af7bf434b098a7554dada956f11ed50c1b895 xsa178-unstable/0003-libxl-Do-not-trust-backend-for-vtpm-in-getinfo-excep.patch a2abc4308d9a18f49a02e6ca8ba913d4d9890867b7816dcc19b548836b65af6c xsa178-unstable/0004-libxl-Do-not-trust-backend-for-vtpm-in-getinfo-uuid.patch 2884e6566c59ae95792d4282e174c6b3d201c1e006b9e0ab57fbaad2b62ecfb9 xsa178-unstable/0005-libxl-cdrom-eject-and-insert-write-to-libxl.patch d6ac82211d056a386d18b8296a6a1f2e8a65e8156594595b9c34a3a377f1cf98 xsa178-unstable/0006-libxl-Do-not-trust-backend-for-disk-eject-vdev.patch 4c8bb7bee3b624b02796afdfa0157ea1dc49a7f54f34912f992bae201b6bfe40 xsa178-unstable/0007-libxl-Do-not-trust-backend-for-disk-fix-driver-domai.patch 556b14e8783ddd7ad0cb9a561ca43a40b37ccb27cd56337e7714ac0f796ce21b xsa178-unstable/0008-libxl-Do-not-trust-backend-for-disk-in-getinfo.patch b51aaa8cca1f367ae51ffb65240831617d4cab4a3fa6d0a2d42728e99ee8cee8 xsa178-unstable/0009-libxl-Do-not-trust-backend-for-cdrom-insert.patch 3ef493e6bda2d2b96a89cf18b55d43fbdb84a2cd5c10c88f04299434c629ba2b xsa178-unstable/0010-libxl-Do-not-trust-backend-for-channel-in-getinfo.patch da4db890c9e73fca006bc381f2208f9bff0fc35990c4dd51d59999db27072d33 xsa178-unstable/0011-libxl-Rename-libxl__device_-nic-channel-_from_xs_be-.patch ae8b043a83cc35beee2205ab621b6f5bc6543f6d4dcdc06c97e07b1a17ca94bf xsa178-unstable/0012-libxl-Rename-READ_BACKEND-to-READ_LIBXLDEV.patch 936c44de9a344b0634b7bff4f5b3cf9c034a0080e87d267e7a84683a967d1bff xsa178-unstable/0013-libxl-Have-READ_LIBXLDEV-use-libxl_path-rather-than-.patch 3b65a3140387651cf2ed1bcf8668efecd58fbd274a62a03d785c269b55bea8fe xsa178-unstable/0014-libxl-Do-not-trust-backend-in-nic-getinfo.patch 6d009153b98fd58f316efa4f39c821cf609b54184726e15f887947321610ed14 xsa178-unstable/0015-libxl-Do-not-trust-backend-for-nic-in-devid_to_devic.patch 3105c062bb2017681f47499e2dd2f6cd2996539068f216a5af7d6143bc726eda xsa178-unstable/0016-libxl-Do-not-trust-backend-for-nic-in-list.patch 97961ce38d8d77e9d91ee85052fd33e04d19f45e5ddfec61f82dc9c8a78158ea xsa178-unstable/0017-libxl-Do-not-trust-backend-in-channel-list.patch 6ebb611501b66dca66259d3a790e30ae6d892eb27c6d06577d8f399d619c286b xsa178-unstable/0018-libxl-Do-not-trust-backend-for-vusb.patch c557196a8fd6d41eaa3224b16cce3f998172aeac995bc6794829458fc6bc3ebc xsa178-unstable/0019-libxl-Cleanup-Have-libxl__alloc_vdev-use-libxl.patch 3c04f5b7815fe50b37e657de8e93fd86faa7046ceb6d5257b6c009be73c332bd xsa178-unstable/0020-libxl-Cleanup-use-libxl__backendpath_parse_domid-in-.patch 0d320cac51503d2cd57fc0de081563d6f63dd7635f65bcf62059a9294cddc7af xsa178-unstable/0021-libxl-Document-serial-correctly.patch
Files sent to developer in a secure (encrypted) channel. Bug #583464, could be addressing same vulnerability. Purposely split it up in case can not be handled together. If can be handled as one release, either one could be set as dependancy.
commit f22d36084c5cdabb599a38b8e1e26832c4bacd94 Author: Yixun Lan <dlan@gentoo.org> Date: Tue Jun 7 13:38:13 2016 +0800 app-emulation/xen-tools: fix XSA-175,178 bug also include a few non-security upstream fixes Gentoo-Bug: 583464, XSA-175 Gentoo-Bug: 583466, XSA-178 Package-Manager: portage-2.3.0_rc1
@ Security: Please vote!
CVE-2016-4963 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4963): The libxl device-handling in Xen through 4.6.x allows local guest OS users with access to the driver domain to cause a denial of service (management tool confusion) by manipulating information in the backend directories in xenstore.
GLSA Vote: No