First Last Prev Next    This bug is not in your last search results.
Bug 1179501 - (CVE-2020-29484) VUL-0: CVE-2020-29484: xen: xenstore: guests can crash xenstored via watchs (XSA-324 v3)
(CVE-2020-29484)
VUL-0: CVE-2020-29484: xen: xenstore: guests can crash xenstored via watchs (...
Status: NEW
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents
unspecified
Other Other
: P3 - Medium : Normal
: ---
Assigned To: Security Team bot
Security Team bot
https://smash.suse.de/issue/272604/
CVSSv3.1:SUSE:CVE-2020-29484:6.5:(AV:...
:
Depends on:
Blocks:
  Show dependency tree / graph
 
Reported: 2020-12-02 09:20 UTC by Robert Frohl
Modified: 2021-01-22 20:55 UTC (History)
2 users (show)

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Comment 4 Wolfgang Frisch 2020-12-15 13:12:30 UTC 
via oss-security:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

            Xen Security Advisory CVE-2020-29484 / XSA-324
                               version 3

            Xenstore: guests can crash xenstored via watchs

UPDATES IN VERSION 3
====================

Public release.

ISSUE DESCRIPTION
=================

When a Xenstore watch fires, the xenstore client which registered the
watch will receive a Xenstore message containing the path of the
modified Xenstore entry which triggered the watch, and the tag which
was specified when registering the watch.

Any communication with xenstored is done via Xenstore messages,
consisting of a message header and the payload. The payload length is
limited to 4096 bytes. Any request to xenstored resulting in a
response with a payload longer than 4096 bytes will result in an
error.

When registering a watch the payload length limit applies to the
combined length of the watched path and the specified tag. As watches
for a specific path are also triggered for all nodes below that path,
the payload of a watch event message can be longer than the payload
needed to register the watch.

A malicious guest which registers a watch using a very large tag (ie
with a registration operation payload length close to the 4096 byte
limit) can cause the generation of watch events with a payload length
larger than 4096 bytes, by writing to Xenstore entries below the
watched path.

This will result in an error condition in xenstored.  This error can
result in a NULL pointer dereference leading to a crash of xenstored.

IMPACT
======

A malicious guest administrator can cause xenstored to crash, leading
to a denial of service.  Following a xenstored crash, domains may
continue to run, but management operations will be impossible.

VULNERABLE SYSTEMS
==================

All Xen versions are affected.

Only C xenstored is affected, oxenstored is not affected.

MITIGATION
==========

There are no mitigations.

Changing to use of Ocaml xenstored would avoid this vulnerability.
However, given the other vulnerabilities in both versions of xenstored
being reported at this time, changing xenstored implementation is not a
recommended approach to mitigation of individual issues.

CREDITS
=======

This issue was discovered by Jürgen Groß of SUSE.

RESOLUTION
==========

Applying the appropriate attached patch resolves this issue.

Note that patches for released versions are generally prepared to
apply to the stable branches, and may not apply cleanly to the most
recent release tarball.  Downstreams are encouraged to update to the
tip of the stable branch before applying these patches.

xsa324.patch           xen-unstable - 4.10

$ sha256sum xsa324*
78932f0a83b479902553b1acdf601f7625b383497c03c6e834a0a2b847f1a72e  xsa324.meta
8dba79842fa913290c7043d065a50abb0efe27fa5a173e421c21c544cc1e264c  xsa324.patch
$

DEPLOYMENT DURING EMBARGO
=========================

Deployment of the patches and/or mitigations described above (or
others which are substantially similar) is permitted during the
embargo, even on public-facing systems with untrusted guest users and
administrators.

But: Distribution of updated software is prohibited (except to other
members of the predisclosure list).

Predisclosure list members who wish to deploy significantly different
patches and/or mitigations, please contact the Xen Project Security
Team.

(Note: this during-embargo deployment notice is retained in
post-embargo publicly released Xen Project advisories, even though it
is then no longer applicable.  This is to enable the community to have
oversight of the Xen Project Security Team's decisionmaking.)

For more information about permissible uses of embargoed information,
consult the Xen Project community's agreed Security Policy:
  http://www.xenproject.org/security-policy.html
-----BEGIN PGP SIGNATURE-----

iQFABAEBCAAqFiEEI+MiLBRfRHX6gGCng/4UyVfoK9kFAl/Yqd4MHHBncEB4ZW4u
b3JnAAoJEIP+FMlX6CvZBoIH/ir2NdOiUg6JFoa/DXgtMBosLXRkRRjikvlaMJTY
krz3r/aBZ0nLn8wsF5u+BctJYdHrIQDrt3N7GGv1wyvnLA18HrtupsxqrHj+CCMD
pogl6QxRmmqRina7+EzRTt8N8qe6fhi8tuVmH3TYlsL1PeHyqNurwwTZizHL9BFx
uCY10qNUV0FTY05tUhdP0FD3yiNfN8QwytARo/LRhELbUMx7D+N/CmUtCKh5uklr
KfBBHy3Vb4MDlGPN7pa5vdEjZGFVj4xHWxUP+72C+bdhvLEiDi+IKkvy/TVbjoAN
eQEfFVjBpj21MeQV+3mHJMJGknaJ8NTc00txrLM5D+WscHM=
=KypE
-----END PGP SIGNATURE-----
Comment 5 Swamp Workflow Management 2020-12-16 20:18:46 UTC 
SUSE-SU-2020:14578-1: An update that fixes 8 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1179477,1179496,1179498,1179501,1179502,1179506,1179514,1179516
CVE References: CVE-2020-29130,CVE-2020-29480,CVE-2020-29481,CVE-2020-29483,CVE-2020-29484,CVE-2020-29566,CVE-2020-29570,CVE-2020-29571
JIRA References: 
Sources used:
SUSE Linux Enterprise Server 11-SP4-LTSS (src):    xen-4.4.4_48-61.61.1
SUSE Linux Enterprise Debuginfo 11-SP4 (src):    xen-4.4.4_48-61.61.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 7 Swamp Workflow Management 2020-12-18 20:21:31 UTC 
SUSE-SU-2020:3881-1: An update that solves 7 vulnerabilities and has two fixes is now available.

Category: security (moderate)
Bug References: 1027519,1176782,1179496,1179498,1179501,1179502,1179506,1179514,1179516
CVE References: CVE-2020-29480,CVE-2020-29481,CVE-2020-29483,CVE-2020-29484,CVE-2020-29566,CVE-2020-29570,CVE-2020-29571
JIRA References: 
Sources used:
SUSE Linux Enterprise Module for Server Applications 15-SP1 (src):    xen-4.12.4_06-3.40.1
SUSE Linux Enterprise Module for Basesystem 15-SP1 (src):    xen-4.12.4_06-3.40.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 8 Swamp Workflow Management 2020-12-18 20:23:22 UTC 
SUSE-SU-2020:3880-1: An update that solves 9 vulnerabilities and has two fixes is now available.

Category: security (moderate)
Bug References: 1027519,1163019,1176782,1179477,1179496,1179498,1179501,1179502,1179506,1179514,1179516
CVE References: CVE-2020-29130,CVE-2020-29480,CVE-2020-29481,CVE-2020-29483,CVE-2020-29484,CVE-2020-29566,CVE-2020-29570,CVE-2020-29571,CVE-2020-8608
JIRA References: 
Sources used:
SUSE Linux Enterprise Software Development Kit 12-SP5 (src):    xen-4.12.4_06-3.36.1
SUSE Linux Enterprise Server 12-SP5 (src):    xen-4.12.4_06-3.36.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 9 Swamp Workflow Management 2020-12-22 11:16:06 UTC 
openSUSE-SU-2020:2313-1: An update that solves 7 vulnerabilities and has two fixes is now available.

Category: security (moderate)
Bug References: 1027519,1176782,1179496,1179498,1179501,1179502,1179506,1179514,1179516
CVE References: CVE-2020-29480,CVE-2020-29481,CVE-2020-29483,CVE-2020-29484,CVE-2020-29566,CVE-2020-29570,CVE-2020-29571
JIRA References: 
Sources used:
openSUSE Leap 15.1 (src):    xen-4.12.4_06-lp151.2.36.1
Comment 10 Swamp Workflow Management 2020-12-22 17:22:20 UTC 
SUSE-SU-2020:3916-1: An update that solves 7 vulnerabilities and has two fixes is now available.

Category: security (moderate)
Bug References: 1027519,1176782,1179496,1179498,1179501,1179502,1179506,1179514,1179516
CVE References: CVE-2020-29480,CVE-2020-29481,CVE-2020-29483,CVE-2020-29484,CVE-2020-29566,CVE-2020-29570,CVE-2020-29571
JIRA References: 
Sources used:
SUSE Linux Enterprise Server for SAP 15 (src):    xen-4.10.4_24-3.53.1
SUSE Linux Enterprise High Performance Computing 15-LTSS (src):    xen-4.10.4_24-3.53.1
SUSE Linux Enterprise High Performance Computing 15-ESPOS (src):    xen-4.10.4_24-3.53.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 11 Swamp Workflow Management 2020-12-22 17:24:05 UTC 
SUSE-SU-2020:3913-1: An update that solves 8 vulnerabilities and has two fixes is now available.

Category: security (moderate)
Bug References: 1027519,1176782,1179477,1179496,1179498,1179501,1179502,1179506,1179514,1179516
CVE References: CVE-2020-29130,CVE-2020-29480,CVE-2020-29481,CVE-2020-29483,CVE-2020-29484,CVE-2020-29566,CVE-2020-29570,CVE-2020-29571
JIRA References: 
Sources used:
SUSE OpenStack Cloud 7 (src):    xen-4.7.6_14-43.73.1
SUSE Linux Enterprise Server for SAP 12-SP2 (src):    xen-4.7.6_14-43.73.1
SUSE Linux Enterprise Server 12-SP2-LTSS (src):    xen-4.7.6_14-43.73.1
SUSE Linux Enterprise Server 12-SP2-BCL (src):    xen-4.7.6_14-43.73.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 12 Swamp Workflow Management 2020-12-22 17:25:50 UTC 
SUSE-SU-2020:3914-1: An update that solves 8 vulnerabilities and has two fixes is now available.

Category: security (moderate)
Bug References: 1027519,1176782,1179477,1179496,1179498,1179501,1179502,1179506,1179514,1179516
CVE References: CVE-2020-29130,CVE-2020-29480,CVE-2020-29481,CVE-2020-29483,CVE-2020-29484,CVE-2020-29566,CVE-2020-29570,CVE-2020-29571
JIRA References: 
Sources used:
SUSE OpenStack Cloud Crowbar 9 (src):    xen-4.11.4_16-2.48.1
SUSE OpenStack Cloud 9 (src):    xen-4.11.4_16-2.48.1
SUSE Linux Enterprise Server for SAP 12-SP4 (src):    xen-4.11.4_16-2.48.1
SUSE Linux Enterprise Server 12-SP4-LTSS (src):    xen-4.11.4_16-2.48.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 13 Swamp Workflow Management 2020-12-22 17:29:09 UTC 
SUSE-SU-2020:3915-1: An update that solves 7 vulnerabilities and has two fixes is now available.

Category: security (moderate)
Bug References: 1027519,1176782,1179496,1179498,1179501,1179502,1179506,1179514,1179516
CVE References: CVE-2020-29480,CVE-2020-29481,CVE-2020-29483,CVE-2020-29484,CVE-2020-29566,CVE-2020-29570,CVE-2020-29571
JIRA References: 
Sources used:
SUSE Linux Enterprise Module for Server Applications 15-SP2 (src):    xen-4.13.2_06-3.22.1
SUSE Linux Enterprise Module for Basesystem 15-SP2 (src):    xen-4.13.2_06-3.22.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 14 Swamp Workflow Management 2020-12-26 11:16:52 UTC 
openSUSE-SU-2020:2331-1: An update that solves 7 vulnerabilities and has two fixes is now available.

Category: security (moderate)
Bug References: 1027519,1176782,1179496,1179498,1179501,1179502,1179506,1179514,1179516
CVE References: CVE-2020-29480,CVE-2020-29481,CVE-2020-29483,CVE-2020-29484,CVE-2020-29566,CVE-2020-29570,CVE-2020-29571
JIRA References: 
Sources used:
openSUSE Leap 15.2 (src):    xen-4.13.2_06-lp152.2.21.1
Comment 15 Swamp Workflow Management 2020-12-29 17:16:52 UTC 
SUSE-SU-2020:3945-1: An update that solves 8 vulnerabilities and has two fixes is now available.

Category: security (moderate)
Bug References: 1027519,1176782,1179477,1179496,1179498,1179501,1179502,1179506,1179514,1179516
CVE References: CVE-2020-29130,CVE-2020-29480,CVE-2020-29481,CVE-2020-29483,CVE-2020-29484,CVE-2020-29566,CVE-2020-29570,CVE-2020-29571
JIRA References: 
Sources used:
SUSE OpenStack Cloud Crowbar 8 (src):    xen-4.9.4_16-3.80.1
SUSE OpenStack Cloud 8 (src):    xen-4.9.4_16-3.80.1
SUSE Linux Enterprise Server for SAP 12-SP3 (src):    xen-4.9.4_16-3.80.1
SUSE Linux Enterprise Server 12-SP3-LTSS (src):    xen-4.9.4_16-3.80.1
SUSE Linux Enterprise Server 12-SP3-BCL (src):    xen-4.9.4_16-3.80.1
SUSE Enterprise Storage 5 (src):    xen-4.9.4_16-3.80.1
HPE Helion Openstack 8 (src):    xen-4.9.4_16-3.80.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 19 Charles Arnold 2021-01-22 20:55:28 UTC 
Backported and released to 11-SP1.
First Last Prev Next    This bug is not in your last search results.