Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2014.1045.2
Xen Security Advisory XSA-101
11 July 2014
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: Xen
Publisher: Xen
Operating System: UNIX variants (UNIX, Linux, OSX)
Xen
Impact/Access: Access Confidential Data -- Existing Account
Resolution: Patch/Upgrade
CVE Names: CVE-2014-4022
Original Bulletin:
http://xenbits.xenproject.org/xsa/advisory-101.html
Revision History: July 11 2014: Provide the CVE.
June 27 2014: Initial Release
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Xen Security Advisory CVE-2014-4022 / XSA-101
version 3
information leak via gnttab_setup_table on ARM
UPDATES IN VERSION 3
====================
Provide the CVE.
ISSUE DESCRIPTION
=================
When initialising an internal data structure on ARM platform Xen was
not correctly initialising the memory containing the list of a
domain's grant table pages. This list is returned by the
GNTTABOP_setup_table subhypercall, leading to an information leak.
IMPACT
======
Malicious guest administrators can obtain some of the memory contents
of other domains:
Up to 8*max_nr_grant_frames bytes of uninitialised memory can be
leaked to the calling domain. This memory may have been previously
used by either the hypervisor or other guests.
The default max_nr_grant_frames is 32, hence by default 256 bytes may
be leaked in this way. However this can be overridden via the
"gnttab_max_nr_frames" hypervisor command line option.
VULNERABLE SYSTEMS
==================
Both 32- and 64-bit ARM systems are vulnerable from Xen 4.4 onward.
MITIGATION
==========
None.
CREDITS
=======
This issue was discovered by Julien Grall.
RESOLUTION
==========
Applying the attached patch resolves this issue.
xsa101.patch xen-unstable, Xen 4.4.x
$ sha256sum xsa101*.patch
12ea475265a0804a3a42f620d7065a7408a5ae4b017c871847424c7247c204e9 xsa101.patch
$
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
iQEcBAEBAgAGBQJTsXKlAAoJEIP+FMlX6CvZAXwH/0Km16VstdF5P72chl3u9BsE
aWLe8Xdb9lmPXiIWM+q2NN+Jp8tL08Ia4fyD1OC5zJqtf6TReI9qsBkzo2O6EfjF
QdTluXrfYgkob0THsDW1Nd86wxy8UBLlz1dwu+jfKkYp9gMQgTtV1NNyrXEOwn1f
vepA/V2kOVss7U5+OXqe10HOm+bK4Qs0vYwu1HnG/y6/I39eP2FXw8jMDSB1pKcJ
1/zBll+R+LVXsQbJbKA6vS9RJiOeMXY1b8y6ThduVuW+bq/RydyqoTb25XPqhHcV
6FaDe3JlncXvpJp4OEaAiHPyBqPRvNgr3WWW16lFGTtlLJdc+43/24WkrLfok6o=
=srxg
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBU786LhLndAQH1ShLAQKaphAAiOYS7I/3p14ukBdSWKWP5cHp3bg7kRZz
+p5unp8nkkL+sRc6LSSAvxe7UzH6RQpiyNou2a7BvVp38sfpVxT58I5p1wZLopMj
n5ZbxF1J22yQkyPjxdia7IOKK4anBVjFL5t4ZMk6xfs0N8ZFH/9fwmiLnd7X5UE6
Zoub0XMXbwYg8UE9xEU4j+u55YiNnmtRCrwmvLLSbAVY/wMdQ8iRGjogh5Fx3H5H
lDZnOT7R35PMsxSlJQDMr5QhVgqvtCxOgTSOA2RhGBZ8f+uI9xYXwiPpjk2BZJu8
xBm9kJqaq9w2wTb7sm0JOT3LykntKoEgDXG3+PgPfvcTc30ltts4MA1b3inFH6UX
lotjLVQXiOffg7Za2YQrr/+tgULuLOrG30K4z1n//a36NUqcV7N59OiG9reWz11Q
EX7+C3rY/61g1FbtRY8+xp5Fo35D0TKrgYq+3ylDoFncbF7j1+6D0s6cqpcgLSZF
JhYCfaTh/4VRj9rOILZY7Gtkvr9Uk37C5I6GdKCZozOkEJIhFBfcsga4NSObviTB
RepSyekogI88KKPDlsgjdwAjiAOs6XrCzx3pYdg2tuXpJKDFc5Dz1yu/j1Arj2Hm
cwIRzkjhoXarY4eQyvcIHjQ1Owf6voyQhFi6o7mWOcQoWOrM+xNg9H3+lvNQM6hq
D2g96Joy0DA=
=M+Gd
-----END PGP SIGNATURE-----