Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 583466 (CVE-2016-4963) - <app-emulation/xen{,-tools}-4.6.1-r4: Unsanitised driver domain input in libxl device handling XSA-178 (CVE-2016-4963)
Summary: <app-emulation/xen{,-tools}-4.6.1-r4: Unsanitised driver domain input in libx...
Status: RESOLVED FIXED
Alias: CVE-2016-4963
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo Security
URL:
Whiteboard: C3 [noglsa cve]
Keywords:
Depends on:
Blocks:
 
Reported: 2016-05-19 03:38 UTC by Yury German
Modified: 2016-11-22 03:37 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Yury German Gentoo Infrastructure gentoo-dev 2016-05-19 03:38:28 UTC
Xen Security Advisory XSA-178

       Unsanitised driver domain input in libxl device handling

              *** EMBARGOED UNTIL 2016-06-02 12:00 UTC ***

ISSUE DESCRIPTION
=================

libxl's device-handling code freely uses and trusts information from
the backend directories in xenstore.

The backend domain (driver domain) can store bogus data in the
backend, causing libxl's enquiry functions to fail, confusing
management tools.

A driver domain can also remove its backend directory from xenstore
entirely, preventing the device from showing up in device listings and
preventing it from being removed and replaced.

A driver domain can cause libxl to generate disk eject events for
disks for which the driver domain is not responsible.

IMPACT
======

A malicious driver domain can deny service to management tools.

VULNERABLE SYSTEMS
==================

This vulnerability is only applicable to systems which are using
driver domains, and then only where the driver domain is not intended
to be fully trusted with respect to the host.

Such Xen systems using libxl based toolstacks (for example xl or
libvirt with the libxl driver) are vulnerable.

Note that even with this vulnerability a driver domain based system is
better from a security point of view, than a system where devices are
provided directly by dom0.  Users and vendors of systems using driver
domains should not change their configuration.

MITIGATION
==========

No mitigation is available.

RESOLUTION
==========

Applying the appropriate attached patch set from XSA-175, plus the
appropriate attached patch set below, resolves this issue.

xsa178-unstable/*.patch           xen-unstable

$ sha256sum xsa178-*/*
fd6a1f858d44f618a4e792553598005871f63d12e718bc9b5477d14bf0113386  xsa178-unstable/0001-libxl-Make-copy-of-every-xs-backend-in-libxl-in-_gen.patch
ee6cf66ad385203c49d9b030959715fb885a250aa36b85080e6985a603bb1ddb  xsa178-unstable/0002-libxl-Do-not-trust-backend-in-libxl__device_exists.patch
ea29cf28609c2d467fb7a620601af7bf434b098a7554dada956f11ed50c1b895  xsa178-unstable/0003-libxl-Do-not-trust-backend-for-vtpm-in-getinfo-excep.patch
a2abc4308d9a18f49a02e6ca8ba913d4d9890867b7816dcc19b548836b65af6c  xsa178-unstable/0004-libxl-Do-not-trust-backend-for-vtpm-in-getinfo-uuid.patch
2884e6566c59ae95792d4282e174c6b3d201c1e006b9e0ab57fbaad2b62ecfb9  xsa178-unstable/0005-libxl-cdrom-eject-and-insert-write-to-libxl.patch
d6ac82211d056a386d18b8296a6a1f2e8a65e8156594595b9c34a3a377f1cf98  xsa178-unstable/0006-libxl-Do-not-trust-backend-for-disk-eject-vdev.patch
4c8bb7bee3b624b02796afdfa0157ea1dc49a7f54f34912f992bae201b6bfe40  xsa178-unstable/0007-libxl-Do-not-trust-backend-for-disk-fix-driver-domai.patch
556b14e8783ddd7ad0cb9a561ca43a40b37ccb27cd56337e7714ac0f796ce21b  xsa178-unstable/0008-libxl-Do-not-trust-backend-for-disk-in-getinfo.patch
b51aaa8cca1f367ae51ffb65240831617d4cab4a3fa6d0a2d42728e99ee8cee8  xsa178-unstable/0009-libxl-Do-not-trust-backend-for-cdrom-insert.patch
3ef493e6bda2d2b96a89cf18b55d43fbdb84a2cd5c10c88f04299434c629ba2b  xsa178-unstable/0010-libxl-Do-not-trust-backend-for-channel-in-getinfo.patch
da4db890c9e73fca006bc381f2208f9bff0fc35990c4dd51d59999db27072d33  xsa178-unstable/0011-libxl-Rename-libxl__device_-nic-channel-_from_xs_be-.patch
ae8b043a83cc35beee2205ab621b6f5bc6543f6d4dcdc06c97e07b1a17ca94bf  xsa178-unstable/0012-libxl-Rename-READ_BACKEND-to-READ_LIBXLDEV.patch
936c44de9a344b0634b7bff4f5b3cf9c034a0080e87d267e7a84683a967d1bff  xsa178-unstable/0013-libxl-Have-READ_LIBXLDEV-use-libxl_path-rather-than-.patch
3b65a3140387651cf2ed1bcf8668efecd58fbd274a62a03d785c269b55bea8fe  xsa178-unstable/0014-libxl-Do-not-trust-backend-in-nic-getinfo.patch
6d009153b98fd58f316efa4f39c821cf609b54184726e15f887947321610ed14  xsa178-unstable/0015-libxl-Do-not-trust-backend-for-nic-in-devid_to_devic.patch
3105c062bb2017681f47499e2dd2f6cd2996539068f216a5af7d6143bc726eda  xsa178-unstable/0016-libxl-Do-not-trust-backend-for-nic-in-list.patch
97961ce38d8d77e9d91ee85052fd33e04d19f45e5ddfec61f82dc9c8a78158ea  xsa178-unstable/0017-libxl-Do-not-trust-backend-in-channel-list.patch
6ebb611501b66dca66259d3a790e30ae6d892eb27c6d06577d8f399d619c286b  xsa178-unstable/0018-libxl-Do-not-trust-backend-for-vusb.patch
c557196a8fd6d41eaa3224b16cce3f998172aeac995bc6794829458fc6bc3ebc  xsa178-unstable/0019-libxl-Cleanup-Have-libxl__alloc_vdev-use-libxl.patch
3c04f5b7815fe50b37e657de8e93fd86faa7046ceb6d5257b6c009be73c332bd  xsa178-unstable/0020-libxl-Cleanup-use-libxl__backendpath_parse_domid-in-.patch
0d320cac51503d2cd57fc0de081563d6f63dd7635f65bcf62059a9294cddc7af  xsa178-unstable/0021-libxl-Document-serial-correctly.patch
Comment 1 Yury German Gentoo Infrastructure gentoo-dev 2016-05-19 03:40:52 UTC
Files sent to developer in a secure (encrypted) channel.

Bug #583464, could be addressing same vulnerability. Purposely split it up in case can not be handled together. If can be handled as one release, either one could be set as dependancy.
Comment 2 Yixun Lan archtester gentoo-dev 2016-06-07 05:48:34 UTC
commit f22d36084c5cdabb599a38b8e1e26832c4bacd94
Author: Yixun Lan <dlan@gentoo.org>
Date:   Tue Jun 7 13:38:13 2016 +0800

    app-emulation/xen-tools: fix XSA-175,178 bug
    
    also include a few non-security upstream fixes
    
    Gentoo-Bug: 583464, XSA-175
    Gentoo-Bug: 583466, XSA-178
    
    Package-Manager: portage-2.3.0_rc1
Comment 3 Thomas Deutschmann (RETIRED) gentoo-dev 2016-11-21 13:22:11 UTC
@ Security: Please vote!
Comment 4 GLSAMaker/CVETool Bot gentoo-dev 2016-11-22 03:32:57 UTC
CVE-2016-4963 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4963):
  The libxl device-handling in Xen through 4.6.x allows local guest OS users
  with access to the driver domain to cause a denial of service (management
  tool confusion) by manipulating information in the backend directories in
  xenstore.
Comment 5 Aaron Bauman (RETIRED) gentoo-dev 2016-11-22 03:37:20 UTC
GLSA Vote: No