Bugzilla – Bug 1042882
VUL-0: CVE-2017-10912: xen: page transfer may allow PV guest to elevate privilege (XSA-217)
Last modified: 2021-01-21 18:17:58 UTC
CRD: 2017-06-20 12:00 UTC
Is public ISSUE DESCRIPTION ================= Domains controlling other domains are permitted to map pages owned by the domain being controlled. If the controlling domain unmaps such a page without flushing the TLB, and if soon after the domain being controlled transfers this page to another PV domain (via GNTTABOP_transfer or, indirectly, XENMEM_exchange), and that third domain uses the page as a page table, the controlling domain will have write access to a live page table until the applicable TLB entry is flushed or evicted. Note that the domain being controlled is necessarily HVM, while the controlling domain is PV. IMPACT ====== A malicious pair of guests may be able to access all of system memory, allowing for all of privilege escalation, host crashes, and information leaks. VULNERABLE SYSTEMS ================== All Xen versions are vulnerable. Only x86 systems are affected. ARM systems are not vulnerable. Only systems where an attacker can control both a PV and an HVM guest are vulnerable. This must be presumed to include systems containing HVM domains with service domains such as stub domain device models. Systems containing only PV guests are not vulnerable. Systems containing only HVM domains serviced by dom0 device model processes are not vulnerable. Note that with libxl, xl, and libvirt, HVM domains use dom0 device model processes by default. MITIGATION ========== There is no mitigation for this vulnerability. Switching from stub device models to dom0 process device models is not recommended as a mitigation, as in practice the vulnerability is likely to be hard to exploit through this route; whereas dom0 process device models may have unknown vulnerabilities. CREDITS ======= This issue was discovered by Jann Horn of Google Project Zero. RESOLUTION ========== Applying the appropriate attached patch resolves this issue. xsa217.patch xen-unstable, Xen 4.8.x, Xen 4.7.x, Xen 4.6.x xsa217-4.5.patch Xen 4.5.x $ sha256sum xsa217* 3e896412389d8e59e417ea7bb3d5b47a20de27b8eae0420c98071ce4b17d219c xsa217.patch 4e555cf47faf5e8d2bba4ff8a31fbe72fb11a6c0e3b286f23b26e684a1809705 xsa217-4.5.patch
SUSE-SU-2017:1715-1: An update that solves three vulnerabilities and has 6 fixes is now available. Category: security (important) Bug References: 1034845,1037243,1042160,1042863,1042882,1042893,1042915,1042931,1042938 CVE References: CVE-2017-8309,CVE-2017-8905,CVE-2017-9330 Sources used: SUSE Linux Enterprise Server 11-SP3-LTSS (src): xen-4.2.5_21-44.1 SUSE Linux Enterprise Point of Sale 11-SP3 (src): xen-4.2.5_21-44.1 SUSE Linux Enterprise Debuginfo 11-SP3 (src): xen-4.2.5_21-44.1
SUSE-SU-2017:1742-1: An update that solves two vulnerabilities and has 9 fixes is now available. Category: security (important) Bug References: 1027519,1035642,1037243,1042160,1042882,1042893,1042915,1042923,1042924,1042931,1042938 CVE References: CVE-2017-8309,CVE-2017-9330 Sources used: SUSE Linux Enterprise Software Development Kit 12-SP2 (src): xen-4.7.2_06-42.1 SUSE Linux Enterprise Server 12-SP2 (src): xen-4.7.2_06-42.1 SUSE Linux Enterprise Desktop 12-SP2 (src): xen-4.7.2_06-42.1
SUSE-SU-2017:1770-1: An update that solves 6 vulnerabilities and has 12 fixes is now available. Category: security (important) Bug References: 1014136,1026236,1027519,1031460,1032148,1034845,1036470,1037243,1042160,1042863,1042882,1042893,1042915,1042924,1042931,1042938,1043074,1043297 CVE References: CVE-2017-8112,CVE-2017-8309,CVE-2017-8905,CVE-2017-9330,CVE-2017-9374,CVE-2017-9503 Sources used: SUSE Linux Enterprise Software Development Kit 11-SP4 (src): xen-4.4.4_20-60.3 SUSE Linux Enterprise Server 11-SP4 (src): xen-4.4.4_20-60.3 SUSE Linux Enterprise Debuginfo 11-SP4 (src): xen-4.4.4_20-60.3
SUSE-SU-2017:1795-1: An update that solves 16 vulnerabilities and has two fixes is now available. Category: security (important) Bug References: 1014136,1026236,1027519,1031460,1032148,1034845,1036470,1037243,1042160,1042863,1042882,1042893,1042915,1042924,1042931,1042938,1043074,1043297 CVE References: CVE-2017-10911,CVE-2017-10912,CVE-2017-10913,CVE-2017-10914,CVE-2017-10915,CVE-2017-10917,CVE-2017-10918,CVE-2017-10920,CVE-2017-10921,CVE-2017-10922,CVE-2017-8112,CVE-2017-8309,CVE-2017-8905,CVE-2017-9330,CVE-2017-9374,CVE-2017-9503 Sources used: SUSE Linux Enterprise Server for SAP 12 (src): xen-4.4.4_21-22.42.1 SUSE Linux Enterprise Server 12-LTSS (src): xen-4.4.4_21-22.42.1
SUSE-SU-2017:1812-1: An update that solves 17 vulnerabilities and has one errata is now available. Category: security (important) Bug References: 1014136,1026236,1027519,1031460,1034845,1036470,1037243,1042160,1042863,1042882,1042893,1042915,1042923,1042924,1042931,1042938,1043074,1043297 CVE References: CVE-2017-10911,CVE-2017-10912,CVE-2017-10913,CVE-2017-10914,CVE-2017-10915,CVE-2017-10916,CVE-2017-10917,CVE-2017-10918,CVE-2017-10920,CVE-2017-10921,CVE-2017-10922,CVE-2017-8112,CVE-2017-8309,CVE-2017-8905,CVE-2017-9330,CVE-2017-9374,CVE-2017-9503 Sources used: SUSE OpenStack Cloud 6 (src): xen-4.5.5_12-22.18.1 SUSE Linux Enterprise Server for SAP 12-SP1 (src): xen-4.5.5_12-22.18.1 SUSE Linux Enterprise Server 12-SP1-LTSS (src): xen-4.5.5_12-22.18.1
openSUSE-SU-2017:1826-1: An update that fixes 11 vulnerabilities is now available. Category: security (important) Bug References: 1027519,1035642,1037243,1042160,1042882,1042893,1042915,1042923,1042924,1042931,1042938 CVE References: CVE-2017-10912,CVE-2017-10913,CVE-2017-10914,CVE-2017-10915,CVE-2017-10917,CVE-2017-10918,CVE-2017-10920,CVE-2017-10921,CVE-2017-10922,CVE-2017-8309,CVE-2017-9330 Sources used: openSUSE Leap 42.2 (src): xen-4.7.2_06-11.9.1
An update workflow for this issue was started. This issue was rated as important. Please submit fixed packages until 2017-08-18. When done, reassign the bug to security-team@suse.de. https://swamp.suse.de/webswamp/wf/63827
Submitted for, SUSE:SLE-10-SP3:Update:Test SUSE:SLE-11-SP1:Update:Teradata SUSE:SLE-11-SP3:Update SUSE:SLE-11-SP4:Update SUSE:SLE-12:Update SUSE:SLE-12-SP1:Update SUSE:SLE-12-SP2:Update
released