Bugzilla – Bug 1191363
VUL-0: CVE-2021-28702: xen: PCI devices with RMRRs not deassigned correctly (XSA-386)
Last modified: 2022-01-27 15:59:37 UTC
Xen Security Advisory CVE-2021-28702 / XSA-386 PCI devices with RMRRs not deassigned correctly ISSUE DESCRIPTION ================= Certain PCI devices in a system might be assigned Reserved Memory Regions (specified via Reserved Memory Region Reporting, "RMRR"). These are typically used for platform tasks such as legacy USB emulation. If such a device is passed through to a guest, then on guest shutdown the device is not properly deassigned. The IOMMU configuration for these devices which are not properly deassigned ends up pointing to a freed data structure, including the IO Pagetables. Subsequent DMA or interrupts from the device will have unpredictable behaviour, ranging from IOMMU faults to memory corruption. IMPACT ====== Administrators of guests which have been assigned RMRR-using PCI devices can cause denial of service and other problems, possibly including escalation of privilege. VULNERABLE SYSTEMS ================== All versions of Xen from at least 4.4 onwards are vulnerable. Only Intel x86 systems are affected. AMD x86 systems, and Arm systems, are all unaffected. Only systems using PCI passthrough are affected. (And then, only if the assigned devices have RMRRs, but whether a device advertises RMRRs is not easy to discern.) MITIGATION ========== There is no mitigation (other than not passing through PCI devices with RMRRs to guests). RESOLUTION ========== Applying the appropriate attached patch resolves this issue. Note that patches for released versions are generally prepared to apply to the stable branches, and may not apply cleanly to the most recent release tarball. Downstreams are encouraged to update to the tip of the stable branch before applying these patches. xsa386.patch xen-unstable - Xen 4.12.x $ sha256sum xsa386* f2f83c825e249bba9454437b48bbd8307fe7a224f56484388a67af124dfd279b xsa386.patch $ NOTE CONCERNING LACK OF EMBARGO =============================== This issue was reported and debugged in public before the security nature became apparent. References: https://xenbits.xen.org/xsa/advisory-386.html
Created attachment 852961 [details] xsa386.patch
Xen Security Advisory CVE-2021-28702 / XSA-386 version 2 PCI devices with RMRRs not deassigned correctly UPDATES IN VERSION 2 ==================== Updated/corrected information about vulnerable versions. Upstream Xen 4.12 is not affected. There is no harm from applying the patch to an unaffected version.
SUSE-SU-2021:3852-1: An update that fixes 7 vulnerabilities is now available. Category: security (moderate) Bug References: 1027519,1191363,1191510,1192554,1192557,1192559 CVE References: CVE-2021-28702,CVE-2021-28704,CVE-2021-28705,CVE-2021-28706,CVE-2021-28707,CVE-2021-28708,CVE-2021-28709 JIRA References: Sources used: SUSE Linux Enterprise Software Development Kit 12-SP5 (src): xen-4.12.4_16-3.55.1 SUSE Linux Enterprise Server 12-SP5 (src): xen-4.12.4_16-3.55.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2021:3888-1: An update that fixes 7 vulnerabilities is now available. Category: security (moderate) Bug References: 1027519,1191363,1192554,1192557,1192559 CVE References: CVE-2021-28702,CVE-2021-28704,CVE-2021-28705,CVE-2021-28706,CVE-2021-28707,CVE-2021-28708,CVE-2021-28709 JIRA References: Sources used: SUSE MicroOS 5.0 (src): xen-4.13.4_02-3.40.1 SUSE Linux Enterprise Module for Server Applications 15-SP2 (src): xen-4.13.4_02-3.40.1 SUSE Linux Enterprise Module for Basesystem 15-SP2 (src): xen-4.13.4_02-3.40.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
openSUSE-SU-2021:1543-1: An update that fixes 7 vulnerabilities is now available. Category: security (moderate) Bug References: 1027519,1191363,1192554,1192557,1192559 CVE References: CVE-2021-28702,CVE-2021-28704,CVE-2021-28705,CVE-2021-28706,CVE-2021-28707,CVE-2021-28708,CVE-2021-28709 JIRA References: Sources used: openSUSE Leap 15.2 (src): xen-4.13.4_02-lp152.2.33.1
SUSE-SU-2021:3968-1: An update that fixes 7 vulnerabilities is now available. Category: security (moderate) Bug References: 1027519,1191363,1192554,1192557,1192559 CVE References: CVE-2021-28702,CVE-2021-28704,CVE-2021-28705,CVE-2021-28706,CVE-2021-28707,CVE-2021-28708,CVE-2021-28709 JIRA References: Sources used: SUSE MicroOS 5.1 (src): xen-4.14.3_04-3.15.1 SUSE Linux Enterprise Module for Server Applications 15-SP3 (src): xen-4.14.3_04-3.15.1 SUSE Linux Enterprise Module for Basesystem 15-SP3 (src): xen-4.14.3_04-3.15.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
openSUSE-SU-2021:3968-1: An update that fixes 7 vulnerabilities is now available. Category: security (moderate) Bug References: 1027519,1191363,1192554,1192557,1192559 CVE References: CVE-2021-28702,CVE-2021-28704,CVE-2021-28705,CVE-2021-28706,CVE-2021-28707,CVE-2021-28708,CVE-2021-28709 JIRA References: Sources used: openSUSE Leap 15.3 (src): xen-4.14.3_04-3.15.1
SUSE-SU-2021:3977-1: An update that fixes 8 vulnerabilities is now available. Category: security (moderate) Bug References: 1027519,1189632,1191363,1192554,1192557,1192559 CVE References: CVE-2021-28701,CVE-2021-28702,CVE-2021-28704,CVE-2021-28705,CVE-2021-28706,CVE-2021-28707,CVE-2021-28708,CVE-2021-28709 JIRA References: Sources used: SUSE Linux Enterprise Server for SAP 15-SP1 (src): xen-4.12.4_16-3.57.1 SUSE Linux Enterprise Server 15-SP1-LTSS (src): xen-4.12.4_16-3.57.1 SUSE Linux Enterprise Server 15-SP1-BCL (src): xen-4.12.4_16-3.57.1 SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (src): xen-4.12.4_16-3.57.1 SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS (src): xen-4.12.4_16-3.57.1 SUSE Enterprise Storage 6 (src): xen-4.12.4_16-3.57.1 SUSE CaaS Platform 4.0 (src): xen-4.12.4_16-3.57.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
these codestreams seem to be missing the fix: - SUSE:SLE-11-SP4:Update/xen - SUSE:SLE-12-SP2:Update/xen - SUSE:SLE-12-SP3:Update/xen - SUSE:SLE-12-SP4:Update/xen - SUSE:SLE-15:Update/xen
(In reply to Robert Frohl from comment #10) > these codestreams seem to be missing the fix: > > - SUSE:SLE-11-SP4:Update/xen > - SUSE:SLE-12-SP2:Update/xen > - SUSE:SLE-12-SP3:Update/xen > - SUSE:SLE-12-SP4:Update/xen > - SUSE:SLE-15:Update/xen Only versions 4.12 through 4.15 are affected (we don't ship 4.15). SLE12-SP5 SLE15-SP1/SP2/SP3 This was changed after the original advisory which stated 4.4 and newer. https://xenbits.xen.org/xsa/advisory-386.html
(In reply to Charles Arnold from comment #11) > (In reply to Robert Frohl from comment #10) > > these codestreams seem to be missing the fix: > > > > - SUSE:SLE-11-SP4:Update/xen > > - SUSE:SLE-12-SP2:Update/xen > > - SUSE:SLE-12-SP3:Update/xen > > - SUSE:SLE-12-SP4:Update/xen > > - SUSE:SLE-15:Update/xen > > Only versions 4.12 through 4.15 are affected (we don't ship 4.15). > SLE12-SP5 > SLE15-SP1/SP2/SP3 > > This was changed after the original advisory which stated 4.4 and newer. > > https://xenbits.xen.org/xsa/advisory-386.html thanks Charles, updated CVE pages data accordingly. Done.