From owner-svn-ports-all@freebsd.org Wed Nov 11 03:22:09 2015 Return-Path: Delivered-To: svn-ports-all@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 338F2A290AF; Wed, 11 Nov 2015 03:22:09 +0000 (UTC) (envelope-from junovitch@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id E49C71793; Wed, 11 Nov 2015 03:22:08 +0000 (UTC) (envelope-from junovitch@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id tAB3M7vW033612; Wed, 11 Nov 2015 03:22:07 GMT (envelope-from junovitch@FreeBSD.org) Received: (from junovitch@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id tAB3M7HR033610; Wed, 11 Nov 2015 03:22:07 GMT (envelope-from junovitch@FreeBSD.org) Message-Id: <201511110322.tAB3M7HR033610@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: junovitch set sender to junovitch@FreeBSD.org using -f From: Jason Unovitch Date: Wed, 11 Nov 2015 03:22:07 +0000 (UTC) To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: svn commit: r401224 - head/security/vuxml X-SVN-Group: ports-head MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-ports-all@freebsd.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: SVN commit messages for the ports tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 11 Nov 2015 03:22:09 -0000 Author: junovitch Date: Wed Nov 11 03:22:07 2015 New Revision: 401224 URL: https://svnweb.freebsd.org/changeset/ports/401224 Log: Document Xen XSAs-{142,148,149,150,151,152,153} Security: CVE-2015-7311 Security: CVE-2015-7835 Security: CVE-2015-7969 Security: CVE-2015-7970 Security: CVE-2015-7971 Security: CVE-2015-7972 Security: https://vuxml.FreeBSD.org/freebsd/301b04d7-881c-11e5-ab94-002590263bf5.html Security: https://vuxml.FreeBSD.org/freebsd/3d9f6260-881d-11e5-ab94-002590263bf5.html Security: https://vuxml.FreeBSD.org/freebsd/83350009-881e-11e5-ab94-002590263bf5.html Security: https://vuxml.FreeBSD.org/freebsd/c0e76d33-8821-11e5-ab94-002590263bf5.html Security: https://vuxml.FreeBSD.org/freebsd/e3792855-881f-11e5-ab94-002590263bf5.html Security: https://vuxml.FreeBSD.org/freebsd/e4848ca4-8820-11e5-ab94-002590263bf5.html Security: https://vuxml.FreeBSD.org/freebsd/fc1f8795-881d-11e5-ab94-002590263bf5.html Modified: head/security/vuxml/vuln.xml Modified: head/security/vuxml/vuln.xml ============================================================================== --- head/security/vuxml/vuln.xml Wed Nov 11 02:16:23 2015 (r401223) +++ head/security/vuxml/vuln.xml Wed Nov 11 03:22:07 2015 (r401224) @@ -58,6 +58,247 @@ Notes: --> + + xen-tools -- populate-on-demand balloon size inaccuracy can crash guests + + + xen-tools + 3.44.5.1_2 + + + + +

The Xen Project reports:

+
Guests configured with PoD might be unstable, especially under + load. In an affected guest, an unprivileged guest user might be + able to cause a guest crash, perhaps simply by applying load so + as to cause heavy memory pressure within the guest.
+

+ + + + CVE-2015-7972 + http://xenbits.xen.org/xsa/advisory-153.html + + + 2015-10-29 + 2015-11-11 + + + + + xen-kernel -- some pmu and profiling hypercalls log without rate limiting + + + xen-kernel + 3.24.5.1_1 + + + + +

The Xen Project reports:

+
HYPERCALL_xenoprof_op and HYPERVISOR_xenpmu_op log some errors and + attempts at invalid operations. These log messages are not + rate-limited, even though they can be triggered by guests.
+
A malicious guest could cause repeated logging to the hypervisor + console, leading to a Denial of Service attack.
+

+ + + + CVE-2015-7971 + http://xenbits.xen.org/xsa/advisory-152.html + + + 2015-10-29 + 2015-11-11 + + + + + xen-kernel -- leak of per-domain profiling-related vcpu pointer array + + + xen-kernel + 4.04.5.1_1 + + + + +

The Xen Project reports:

+
A domain's xenoprofile state contains an array of per-vcpu + information... This array is leaked on domain teardown. This memory + leak could -- over time -- exhaust the host's memory.
+
The following parties can mount a denial of service attack + affecting the whole system:
+
+
A malicious guest administrator via XENOPROF_get_buffer.
+
A domain given suitable privilege over another domain via + XENOPROF_set_passive (this would usually be a domain being + used to profile another domain, eg with the xenoprof tool).
+
+
The ability to also restart or create suitable domains is also + required to fully exploit the issue. Without this the leak is + limited to a small multiple of the maximum number of vcpus for the + domain.
+

+ + + + CVE-2015-7969 + http://xenbits.xen.org/xsa/advisory-151.html + + + 2015-10-29 + 2015-11-11 + + + + + xen-kernel -- Long latency populate-on-demand operation is not preemptible + + + xen-kernel + 3.44.5.1_1 + + + + +

The Xen Project reports:

+
When running an HVM domain in Populate-on-Demand mode, Xen would + sometimes search the domain for memory to reclaim, in response to + demands for population of other pages in the same domain. This + search runs without preemption. The guest can, by suitable + arrangement of its memory contents, create a situation where this + search is a time-consuming linear scan of the guest's address + space.
+
A malicious HVM guest administrator can cause a denial of service. + Specifically, prevent use of a physical CPU for a significant + period.
+

+ + + + CVE-2015-7970 + http://xenbits.xen.org/xsa/advisory-150.html + + + 2015-10-29 + 2015-11-11 + + + + + xen-kernel -- leak of main per-domain vcpu pointer array + + + xen-kernel + 4.5.1_1 + + + + +

The Xen Project reports:

+
A domain's primary array of vcpu pointers can be allocated by a + toolstack exactly once in the lifetime of a domain via the + XEN_DOMCTL_max_vcpus hypercall. This array is leaked on domain + teardown. This memory leak could -- over time -- exhaust the host's + memory.
+
A domain given partial management control via XEN_DOMCTL_max_vcpus + can mount a denial of service attack affecting the whole system. The + ability to also restart or create suitable domains is also required + to fully exploit the issue. Without this the leak is limited to a + small multiple of the maximum number of vcpus for the domain. The + maximum leak is 64kbytes per domain (re)boot (less on ARM).
+

+ + + + CVE-2015-7969 + http://xenbits.xen.org/xsa/advisory-149.html + + + 2015-10-29 + 2015-11-11 + + + + + xen-kernel -- Uncontrolled creation of large page mappings by PV guests + + + xen-kernel + 3.44.5.1_1 + + + + +

The Xen Project reports:

+
The code to validate level 2 page table entries is bypassed when + certain conditions are satisfied. This means that a PV guest can + create writeable mappings using super page mappings. Such writeable + mappings can violate Xen intended invariants for pages which Xen is + supposed to keep read-only. This is possible even if the + "allowsuperpage" command line option is not used.
+
Malicious PV guest administrators can escalate privilege so as to + control the whole system.
+

+ + + + CVE-2015-7835 + http://xenbits.xen.org/xsa/advisory-148.html + + + 2015-10-29 + 2015-11-11 + + + + + xen-tools -- libxl fails to honour readonly flag on disks with qemu-xen + + + xen-tools + 4.14.5.1_1 + + + + +

The Xen Project reports:

+
Callers of libxl can specify that a disk should be read-only to the + guest. However, there is no code in libxl to pass this information + to qemu-xen (the upstream-based qemu); and indeed there is no way in + qemu to make a disk read-only.
+
The vulnerability is exploitable only via devices emulated by the + device model, not the parallel PV devices for supporting PVHVM. + Normally the PVHVM device unplug protocol renders the emulated + devices inaccessible early in boot.
+
Malicious guest administrators or (in some situations) users may be + able to write to supposedly read-only disk images.
+
CDROM devices (that is, devices specified to be presented to the + guest as CDROMs, regardless of the nature of the backing storage on + the host) are not affected.
+

+ + + + CVE-2015-7311 + http://xenbits.xen.org/xsa/advisory-142.html + + + 2015-09-22 + 2015-11-11 + + + p5-HTML-Scrubber -- XSS vulnerability