|Public release ||2014-11-27 11:25|
|Updated ||2014-11-27 11:25|
|Title ||Insufficient bounding of "REP MOVS" to MMIO emulated inside the hypervisor|
Filesadvisory-112.txt (signed advisory file)
-----BEGIN PGP SIGNED MESSAGE-----
Xen Security Advisory CVE-2014-8867 / XSA-112
Insufficient bounding of "REP MOVS" to MMIO emulated inside the hypervisor
UPDATES IN VERSION 5
Acceleration support for the "REP MOVS" instruction, when the first
iteration accesses memory mapped I/O emulated internally in the
hypervisor, incorrectly assumes that the whole range accessed is
handled by the same hypervisor sub-component.
A buggy or malicious HVM guest can crash the host.
Xen versions from at least 3.2.x onwards are vulnerable on x86 systems.
Older versions have not been inspected. ARM systems are not vulnerable.
Running only PV guests will avoid this issue.
There is no mitigation available for HVM guests.
This issue was discovered by Jan Beulich of SUSE.
Applying the appropriate attached patch resolves this issue.
xsa112-unstable.patch xen-unstable, Xen 4.4.x, Xen 4.3.x
xsa112-4.2.patch Xen 4.2.x
$ sha256sum xsa112*.patch
We have been told that this patch is not sufficient on Xen 3.3.x and
earlier without also backporting b1b6362f (git commit id).
Note that while we are happy to share information we receive about
earlier Xen versions, the earliest Xen branch for which the Xen
Project offers security support is 4.2.x.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
-----END PGP SIGNATURE-----
Xenproject.org Security Team