Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 624128 (CVE-2017-10920, CVE-2017-10921, CVE-2017-10922) - <app-emulation/xen{,-pvgrub,-tools}-4.7.3: grant table operations mishandle reference counts
Summary: <app-emulation/xen{,-pvgrub,-tools}-4.7.3: grant table operations mishandle r...
Status: RESOLVED FIXED
Alias: CVE-2017-10920, CVE-2017-10921, CVE-2017-10922
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal major
Assignee: Gentoo Security
URL: https://xenbits.xen.org/xsa/advisory-...
Whiteboard: B1 [glsa cve]
Keywords:
Depends on:
Blocks: CVE-2017-10912 CVE-2017-10911 CVE-2017-10913, CVE-2017-10914 CVE-2017-10915 CVE-2017-10916 CVE-2017-10917 CVE-2017-10918
  Show dependency tree
 
Reported: 2017-07-07 15:02 UTC by Christopher Díaz Riveros (RETIRED)
Modified: 2018-01-08 21:22 UTC (History)
1 user (show)

See Also:
Package list:
app-emulation/xen-4.7.3 amd64 app-emulation/xen-pvgrub-4.7.3 amd64 x86 app-emulation/xen-tools-4.7.3 amd64 x86
Runtime testing required: ---
stable-bot: sanity-check+


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Christopher Díaz Riveros (RETIRED) gentoo-dev Security 2017-07-07 15:02:12 UTC
From $URL:

ISSUE DESCRIPTION
=================

We have discovered a number of bugs in the code mapping and unmapping
grant references.

* If a grant is mapped with both the GNTMAP_device_map and
GNTMAP_host_map flags, but unmapped only with host_map, the device_map
portion remains but the page reference counts are lowered as though it
had been removed. This bug can be leveraged cause a page's reference
counts and type counts to fall to zero while retaining writeable
mappings to the page.  (CVE-2017-10920.)

* Under some specific conditions, if a grant is mapped with both the
GNTMAP_device_map and GNTMAP_host_map flags, the operation may not
grab sufficient type counts.  When the grant is then unmapped, the
type count will be erroneously reduced.  This bug can be leveraged
cause a page's reference counts and type counts to fall to zero while
retaining writeable mappings to the page.  (CVE-2017-10921.)

* When a grant reference is given to an MMIO region (as opposed to a
normal guest page), if the grant is mapped with only the
GNTMAP_device_map flag set, a mapping is created at host_addr anyway.
This does *not* cause reference counts to change, but there will be no
record of this mapping, so it will not be considered when reporting
whether the grant is still in use.  (CVE-2017-10922.)

IMPACT
======

For the worst issue, a PV guest could gain a writeable mapping of its
own pagetable, allowing it to escalate its privileges to that of the
host.

VULNERABLE SYSTEMS
==================

All versions of Xen are vulnerable.

Only x86 systems are vulnerable.

Any system running untrusted PV guests is vulnerable.

Systems with untrusted HVM guests are only vulnerable if those guests
are served by a trusted PV backend which is vulnerable: Namely, one
which calls grant_map() with both the GNTMAP_device_map and
GNTMAP_host_map flags.  The security team is not aware of any backends
which are vulnerable.

MITIGATION
==========

Running only HVM guests will avoid this vulnerability.

CREDITS
=======

This issue was discovered by Jan Beulich of SUSE.

RESOLUTION
==========

Applying the appropriate set of attached patched resolves this issue.
Note that these patches are assumed to be applied on top of the XSA-218
ones; not doing so may cause at least mechanical problems of applying
the ones here.

xsa224-unstable/*.patch         xen-unstable
xsa224-4.8/*.patch       Xen 4.8.x
xsa224-4.7/*.patch       Xen 4.7.x
xsa224-4.6/*.patch       Xen 4.6.x
xsa224-4.5/*.patch       Xen 4.5.x

$ sha256sum xsa224*/*
db39535185c1879775b62873fbed1e6285300ec1e1bd5d09ac2d96a98ac6443c  xsa224-unstable/0001-gnttab-Fix-handling-of-dev_bus_addr-during-unmap.patch
1588257f5b0c7113cd478475014f56fbeb6e79de7acbe67cf6d7a265e2b3fa15  xsa224-unstable/0002-gnttab-never-create-host-mapping-unless-asked-to.patch
a7517ca0e253fb9fb5b1ea1e56d04167f32ef87be145462a15241af26e4e0d65  xsa224-unstable/0003-gnttab-correct-logic-to-get-page-references-during-m.patch
951217a88f9c945eb9f7933cd66615aef955206fab955020334ac54da05663fa  xsa224-unstable/0004-gnttab-__gnttab_unmap_common_complete-is-all-or-noth.patch
190470fbd77fca58aab89a9bd034732525ce8f7ce7c417a0ca5d25b366639baa  xsa224-4.5/0001-gnttab-Fix-handling-of-dev_bus_addr-during-unmap.patch
9374e4dd6666a63fb32e6cfbdc95071b0cc153ff7cb2d2efdd98468e0e079605  xsa224-4.5/0002-gnttab-never-create-host-mapping-unless-asked-to.patch
d825e6fa5827e28e3755c92b274044666cc91b6a8cbc16e2081f43e0371991d4  xsa224-4.5/0003-gnttab-correct-logic-to-get-page-references-during-m.patch
d3aaffaf487a84e43fe10f7dec5af72b64d1b2315440c36335a0ed8ec1439ca1  xsa224-4.5/0004-gnttab-__gnttab_unmap_common_complete-is-all-or-noth.patch
c6cd6b82ef774bec5eaad5f32e767c917bc7ad2a73ee81d3f7eef67aaf1a1330  xsa224-4.6/0001-gnttab-Fix-handling-of-dev_bus_addr-during-unmap.patch
db32d15757c9d147c7e89eebd10a16324e59141fbb5ce3feb87fc9bf01864a6a  xsa224-4.6/0002-gnttab-never-create-host-mapping-unless-asked-to.patch
6bc9bbcf320d673822bd41545a014bd998294d06c5b38d79a6badf1a154ed0d6  xsa224-4.6/0003-gnttab-correct-logic-to-get-page-references-during-m.patch
088064fec3192928f205b34b808ca40fd685a8ba5037bb665ed0a4f87d6d4035  xsa224-4.6/0004-gnttab-__gnttab_unmap_common_complete-is-all-or-noth.patch
cdd93fb950b823cf96fe52685f6394c1b5e0a1e3d7d3c961a5e781da83551a9f  xsa224-4.7/0001-gnttab-Fix-handling-of-dev_bus_addr-during-unmap.patch
0583da31891084b2557a9623bc2b11a480e296004a8716b91c79fe28a824a6e0  xsa224-4.7/0002-gnttab-never-create-host-mapping-unless-asked-to.patch
2323bf581a835f152285b98ed2e4b5b503b0f67bd8e3449d33e8fe03b14ce064  xsa224-4.7/0003-gnttab-correct-logic-to-get-page-references-during-m.patch
b4f4adb1ea850e0174e51f76da7e97769211977c71809bd62102d33d90444b09  xsa224-4.7/0004-gnttab-__gnttab_unmap_common_complete-is-all-or-noth.patch
88b20e6765f0bfffe7598215f3a8e25c0931dbe3c7223cb3c08f998842cfc14b  xsa224-4.8/0001-gnttab-Fix-handling-of-dev_bus_addr-during-unmap.patch
ce62c97f470d6fbf557f50be8936051e91592a6330527515b7cdb187a0d633b2  xsa224-4.8/0002-gnttab-never-create-host-mapping-unless-asked-to.patch
5fd8cd67737c6a038d6c47fcf3c5bd2d238f4ac361538d650292ee185bda8000  xsa224-4.8/0003-gnttab-correct-logic-to-get-page-references-during-m.patch
f9c65c7f04063872602c609d2fc3caffc44716b3d378569969a7884abe881a19  xsa224-4.8/0004-gnttab-__gnttab_unmap_common_complete-is-all-or-noth.patch
$

DEPLOYMENT DURING EMBARGO
=========================

Deployment of the patches and/or mitigations described above (or
others which are substantially similar) is permitted during the
embargo, even on public-facing systems with untrusted guest users and
administrators.

But: Distribution of updated software is prohibited (except to other
members of the predisclosure list).

Predisclosure list members who wish to deploy significantly different
patches and/or mitigations, please contact the Xen Project Security
Team.

(Note: this during-embargo deployment notice is retained in
post-embargo publicly released Xen Project advisories, even though it
is then no longer applicable.  This is to enable the community to have
oversight of the Xen Project Security Team's decisionmaking.)
Comment 1 Yixun Lan archtester gentoo-dev 2017-07-12 07:33:42 UTC
commit 7a8fc554850ee501e1ad705b4154874adf102947 
Author: Yixun Lan <dlan@gentoo.org>             
Date:   Wed Jul 12 15:15:52 2017 +0800          

    app-emulation/xen: security bump            
                        
    fix XSA-217,218,219,220,221,222,223,224,225 
                        
    Gentoo-Bug: 624112,624114,624116,624118,624120,624122,624124,624126,624130                  
    Package-Manager: Portage-2.3.6, Repoman-2.3.2                                               

:100644 100644 6534404116c... 49df2654a33... M  app-emulation/xen/Manifest                      
:000000 100644 00000000000... f66bd1b70f8... A  app-emulation/xen/xen-4.7.3.ebuild              
:000000 100644 00000000000... bf73951bc39... A  app-emulation/xen/xen-4.8.1-r2.ebuild
Comment 2 Yixun Lan archtester gentoo-dev 2017-07-12 07:37:57 UTC
Arches, please test and mark stable:
=app-emulation/xen-4.7.3
Target keyword only: "amd64" 
	
=app-emulation/xen-pvgrub-4.7.3
=app-emulation/xen-tools-4.7.3
Target keywords: "amd64 x86"
Comment 3 Tobias Klausmann (RETIRED) gentoo-dev 2017-07-31 09:02:16 UTC
Stable on amd64.
Comment 4 Thomas Deutschmann (RETIRED) gentoo-dev 2017-08-20 17:34:02 UTC
x86 stable
Comment 5 Yury German Gentoo Infrastructure gentoo-dev 2017-08-20 22:00:05 UTC
GLSA Vote: Yes
Added to an existing GLSA Request.

Maintainer(s), please drop the vulnerable version(s).
Comment 6 Yury German Gentoo Infrastructure gentoo-dev 2017-09-02 19:27:01 UTC
Maintainers please drop vulnerable packages (4.7.2-r1), please be aware that in the past for some reason x86 was stabilized but it should of never been.

         |                                 |   u   |
         | a a         p s   a     n r     |   n   |
         | l m   h i   p p   r m m i i s   | e u s | r
         | p d a p a p c a x m i 6 o s 3   | a s l | e
         | h 6 r p 6 p 6 r 8 6 p 8 s c 9 s | p e o | p
         | a 4 m a 4 c 4 c 6 4 s k 2 v 0 h | i d t | o
---------+---------------------------------+-------+-------
4.7.2-r1 | o + ~ o o o o o + o o o o o o o | 5 o 0 | gentoo
4.7.3    | o + ~ o o o o o ~ o o o o o o o | 5 o   | gentoo
Comment 7 Yury German Gentoo Infrastructure gentoo-dev 2017-10-01 23:50:24 UTC
Maintainers please remove Vulnerable Versions:

app-emulation/xen-4.7.2-r1
app-emulation/xen-pvgrub-4.7.2
app-emulation/xen-tools-4.7.2

Note: Xen-4.7.2.-r1 should never had x86 stabilized, so please drop stable keywords on that.
Comment 8 GLSAMaker/CVETool Bot gentoo-dev 2017-10-18 00:43:23 UTC
This issue was resolved and addressed in
 GLSA 201710-17 at https://security.gentoo.org/glsa/201710-17
by GLSA coordinator Aaron Bauman (b-man).
Comment 9 Aaron Bauman (RETIRED) gentoo-dev 2017-10-18 00:43:56 UTC
re-opened for cleanup.
Comment 10 Aaron Bauman (RETIRED) gentoo-dev 2017-11-03 19:39:13 UTC
please clean.
Comment 11 Aaron Bauman (RETIRED) gentoo-dev 2018-01-08 21:22:23 UTC
Tree is clean.