Bugzilla – Bug 1197425
VUL-0: CVE-2022-26357: xen: race in VT-d domain ID cleanup (XSA-399)
Last modified: 2022-06-23 13:18:42 UTC
Public! https://xenbits.xen.org/xsa/advisory-399.html Xen Security Advisory CVE-2022-26357 / XSA-399 version 2 race in VT-d domain ID cleanup UPDATES IN VERSION 2 ==================== Public release. ISSUE DESCRIPTION ================= Xen domain IDs are up to 15 bits wide. VT-d hardware may allow for only less than 15 bits to hold a domain ID associating a physical device with a particular domain. Therefore internally Xen domain IDs are mapped to the smaller value range. The cleaning up of the housekeeping structures has a race, allowing for VT-d domain IDs to be leaked and flushes to be bypassed. IMPACT ====== The precise impact is system specific, but would typically be a Denial of Service (DoS) affecting the entire host. Privilege escalation and information leaks cannot be ruled out. VULNERABLE SYSTEMS ================== Xen versions 4.11 through 4.16 are vulnerable. Xen versions 4.10 and earlier are not vulnerable. Only x86 systems with VT-d IOMMU hardware are vulnerable. Arm systems as well as x86 systems without VT-d hardware or without any IOMMUs in use are not vulnerable. Only x86 guests which have physical devices passed through to them can leverage the vulnerability. MITIGATION ========== Not passing through physical devices to untrusted guests will avoid the vulnerability. CREDITS ======= This issue was discovered by Jan Beulich of SUSE. RESOLUTION ========== Applying the appropriate attached patch resolves this issue. Note that patches for released versions are generally prepared to apply to the stable branches, and may not apply cleanly to the most recent release tarball. Downstreams are encouraged to update to the tip of the stable branch before applying these patches. xsa399.patch xen-unstable xsa399-4.16.patch Xen 4.16.x - Xen 4.13.x xsa399-4.12.patch Xen 4.12.x $ sha256sum xsa399* 53b9745564eb21f70dbb7bd7194ff3518f29cd9715c68e9dd7eff25812968019 xsa399.patch 16c3327a60d8ab6c3524f10f57d63efaf2e3e54b807bc285a749cd1a94392a30 xsa399-4.12.patch 79d0f5a0442dec0a806d77a722a1d2c04793572fe0b564bf86dcd1c6d992a679 xsa399-4.16.patch $ DEPLOYMENT DURING EMBARGO ========================= Deployment of the patches described above (or others which are substantially similar) is permitted during the embargo, even on public-facing systems with untrusted guest users and administrators. HOWEVER, deployment of the mitigation is NOT permitted (except where all the affected systems and VMs are administered and used only by organisations which are members of the Xen Project Security Issues Predisclosure List). Specifically, deployment on public cloud systems is NOT permitted. This is because removal of pass-through devices or their replacement by emulated devices is a guest visible configuration change, which may lead to re-discovery of the issue. Deployment of this mitigation is permitted only AFTER the embargo ends. AND: Distribution of updated software is prohibited (except to other members of the predisclosure list). Predisclosure list members who wish to deploy significantly different patches and/or mitigations, please contact the Xen Project Security Team. (Note: this during-embargo deployment notice is retained in post-embargo publicly released Xen Project advisories, even though it is then no longer applicable. This is to enable the community to have oversight of the Xen Project Security Team's decisionmaking.) For more information about permissible uses of embargoed information, consult the Xen Project community's agreed Security Policy: http://www.xenproject.org/security-policy.html
This is an autogenerated message for OBS integration: This bug (1197425) was mentioned in https://build.opensuse.org/request/show/967124 Factory / xen
Backports and submissions to SLE12-SP2 complete. No further work planned.
SUSE-SU-2022:1285-1: An update that fixes 9 vulnerabilities is now available. Category: security (important) Bug References: 1196915,1197423,1197425,1197426 CVE References: CVE-2021-26401,CVE-2022-0001,CVE-2022-0002,CVE-2022-26356,CVE-2022-26357,CVE-2022-26358,CVE-2022-26359,CVE-2022-26360,CVE-2022-26361 JIRA References: Sources used: SUSE OpenStack Cloud Crowbar 9 (src): xen-4.11.4_28-2.73.1 SUSE OpenStack Cloud 9 (src): xen-4.11.4_28-2.73.1 SUSE Linux Enterprise Server for SAP 12-SP4 (src): xen-4.11.4_28-2.73.1 SUSE Linux Enterprise Server 12-SP4-LTSS (src): xen-4.11.4_28-2.73.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2022:1300-1: An update that fixes 9 vulnerabilities is now available. Category: security (important) Bug References: 1194267,1196915,1197423,1197425,1197426 CVE References: CVE-2021-26401,CVE-2022-0001,CVE-2022-0002,CVE-2022-26356,CVE-2022-26357,CVE-2022-26358,CVE-2022-26359,CVE-2022-26360,CVE-2022-26361 JIRA References: Sources used: SUSE Manager Server 4.1 (src): xen-4.13.4_08-150200.3.50.1 SUSE Manager Retail Branch Server 4.1 (src): xen-4.13.4_08-150200.3.50.1 SUSE Manager Proxy 4.1 (src): xen-4.13.4_08-150200.3.50.1 SUSE Linux Enterprise Server for SAP 15-SP2 (src): xen-4.13.4_08-150200.3.50.1 SUSE Linux Enterprise Server 15-SP2-LTSS (src): xen-4.13.4_08-150200.3.50.1 SUSE Linux Enterprise Server 15-SP2-BCL (src): xen-4.13.4_08-150200.3.50.1 SUSE Linux Enterprise Realtime Extension 15-SP2 (src): xen-4.13.4_08-150200.3.50.1 SUSE Linux Enterprise Micro 5.0 (src): xen-4.13.4_08-150200.3.50.1 SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (src): xen-4.13.4_08-150200.3.50.1 SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS (src): xen-4.13.4_08-150200.3.50.1 SUSE Enterprise Storage 7 (src): xen-4.13.4_08-150200.3.50.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2022:1359-1: An update that fixes 9 vulnerabilities is now available. Category: security (important) Bug References: 1196915,1197423,1197425,1197426 CVE References: CVE-2021-26401,CVE-2022-0001,CVE-2022-0002,CVE-2022-26356,CVE-2022-26357,CVE-2022-26358,CVE-2022-26359,CVE-2022-26360,CVE-2022-26361 JIRA References: Sources used: SUSE Linux Enterprise Server for SAP 15 (src): xen-4.10.4_34-150000.3.74.1 SUSE Linux Enterprise High Performance Computing 15-LTSS (src): xen-4.10.4_34-150000.3.74.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS (src): xen-4.10.4_34-150000.3.74.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2022:1375-1: An update that fixes 10 vulnerabilities is now available. Category: security (important) Bug References: 1182846,1196915,1197423,1197425,1197426 CVE References: CVE-2021-20257,CVE-2021-26401,CVE-2022-0001,CVE-2022-0002,CVE-2022-26356,CVE-2022-26357,CVE-2022-26358,CVE-2022-26359,CVE-2022-26360,CVE-2022-26361 JIRA References: Sources used: SUSE Linux Enterprise Server 12-SP2-BCL (src): xen-4.7.6_22-43.88.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2022:1408-1: An update that fixes 9 vulnerabilities is now available. Category: security (important) Bug References: 1196915,1197423,1197425,1197426 CVE References: CVE-2021-26401,CVE-2022-0001,CVE-2022-0002,CVE-2022-26356,CVE-2022-26357,CVE-2022-26358,CVE-2022-26359,CVE-2022-26360,CVE-2022-26361 JIRA References: Sources used: SUSE OpenStack Cloud Crowbar 8 (src): xen-4.9.4_28-3.103.1 SUSE OpenStack Cloud 8 (src): xen-4.9.4_28-3.103.1 SUSE Linux Enterprise Server for SAP 12-SP3 (src): xen-4.9.4_28-3.103.1 SUSE Linux Enterprise Server 12-SP3-LTSS (src): xen-4.9.4_28-3.103.1 SUSE Linux Enterprise Server 12-SP3-BCL (src): xen-4.9.4_28-3.103.1 HPE Helion Openstack 8 (src): xen-4.9.4_28-3.103.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2022:1505-1: An update that fixes 6 vulnerabilities is now available. Category: security (moderate) Bug References: 1197423,1197425,1197426 CVE References: CVE-2022-26356,CVE-2022-26357,CVE-2022-26358,CVE-2022-26359,CVE-2022-26360,CVE-2022-26361 JIRA References: Sources used: SUSE Linux Enterprise Software Development Kit 12-SP5 (src): xen-4.12.4_22-3.66.1 SUSE Linux Enterprise Server 12-SP5 (src): xen-4.12.4_22-3.66.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2022:1506-1: An update that fixes 6 vulnerabilities is now available. Category: security (moderate) Bug References: 1197423,1197425,1197426 CVE References: CVE-2022-26356,CVE-2022-26357,CVE-2022-26358,CVE-2022-26359,CVE-2022-26360,CVE-2022-26361 JIRA References: Sources used: openSUSE Leap 15.3 (src): xen-4.14.4_04-150300.3.24.1 SUSE Linux Enterprise Module for Server Applications 15-SP3 (src): xen-4.14.4_04-150300.3.24.1 SUSE Linux Enterprise Module for Basesystem 15-SP3 (src): xen-4.14.4_04-150300.3.24.1 SUSE Linux Enterprise Micro 5.2 (src): xen-4.14.4_04-150300.3.24.1 SUSE Linux Enterprise Micro 5.1 (src): xen-4.14.4_04-150300.3.24.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2022:2158-1: An update that fixes 9 vulnerabilities is now available. Category: security (important) Bug References: 1197423,1197425,1197426,1199965,1199966 CVE References: CVE-2022-26356,CVE-2022-26357,CVE-2022-26358,CVE-2022-26359,CVE-2022-26360,CVE-2022-26361,CVE-2022-26362,CVE-2022-26363,CVE-2022-26364 JIRA References: Sources used: SUSE Linux Enterprise Server for SAP 15-SP1 (src): xen-4.12.4_24-150100.3.72.1 SUSE Linux Enterprise Server 15-SP1-LTSS (src): xen-4.12.4_24-150100.3.72.1 SUSE Linux Enterprise Server 15-SP1-BCL (src): xen-4.12.4_24-150100.3.72.1 SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (src): xen-4.12.4_24-150100.3.72.1 SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS (src): xen-4.12.4_24-150100.3.72.1 SUSE Enterprise Storage 6 (src): xen-4.12.4_24-150100.3.72.1 SUSE CaaS Platform 4.0 (src): xen-4.12.4_24-150100.3.72.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.