|Public release ||2015-12-17 12:00|
|Updated ||2015-12-17 12:38|
|CVE(s) ||CVE-2015-8551 CVE-2015-8552|
|Title ||Linux pciback missing sanity checks leading to crash|
Filesadvisory-157.txt (signed advisory file)
-----BEGIN PGP SIGNED MESSAGE-----
Xen Security Advisory CVE-2015-8551,CVE-2015-8552 / XSA-157
Linux pciback missing sanity checks leading to crash
UPDATES IN VERSION 3
Removed CVE-2015-8553 from the title of this advisory. We will issue
an update to XSA-120 which documents the assignment of CVE-2015-8553
to the XSA-120 v5+ addendum patch.
Xen PCI backend driver does not perform proper sanity checks on the
Which in turn allows the generic MSI code (called by Xen PCI backend) to be
called incorrectly leading to hitting BUG conditions or causing NULL pointer
exceptions in the MSI code. (CVE-2015-8551)
To exploit this the guest can craft specific sequence of XEN_PCI_OP_*
operations which will trigger this.
Furthermore the frontend can also craft an continous stream of
XEN_PCI_OP_enable_msi which will trigger an continous
stream of WARN() messages triggered by the MSI code leading to the logging
in the initial domain to exhaust disk space. (CVE-2015-8552)
Lastly there is also missing check to verify whether the device has
memory decoding enabled set at the start of the day leading the initial
domain "accesses to the respective MMIO or I/O port ranges would - - on PCI
Express devices - [which can] lead to Unsupported Request responses.
The treatment of such errors is platform specific." (from XSA-120).
Note that if XSA-120 'addendum' patch (re CVE-2015-8553) has been
applied this particular sub-issue is not exploitable.
Malicious guest administrators can cause denial of service. If driver
domains are not in use, the impact is a host crash.
Only x86 systems are vulnerable. ARM systems are not vulnerable.
This bug affects systems using Linux as the driver domain, including
non-disaggregated systems using Linux as dom0.
Linux versions v3.1 and onwards are vulnerable due to supporting PCI
pass-through backend driver.
PV and HVM guests which have been granted access to physical PCI devices
(`PCI passthrough') can take advantage of this vulnerability.
Furthermore, the vulnerability is only applicable when the
passed-through PCI devices are MSI-capable or MSI-X. (Most modern devices
Not using PCI passthrough for PV and HVM guests. Note that for HVM guests
QEMU is used for PCI passthrough - however the toolstack sets up also
the 'PV' PCI which the guest can utilize if it chooses to do so.
This issue was discovered by Konrad Rzeszutek Wilk of Oracle.
Applying the appropriate attached patch resolves this issue.
$ sha256sum xsa157*
DEPLOYMENT DURING EMBARGO
Deployment of the patches and/or mitigations described above (or
others which are substantially similar) is permitted during the
embargo, even on public-facing systems with untrusted guest users and
But: Distribution of updated software is prohibited (except to other
members of the predisclosure list).
Predisclosure list members who wish to deploy significantly different
patches and/or mitigations, please contact the Xen Project Security
(Note: this during-embargo deployment notice is retained in
post-embargo publicly released Xen Project advisories, even though it
is then no longer applicable. This is to enable the community to have
oversight of the Xen Project Security Team's decisionmaking.)
For more information about permissible uses of embargoed information,
consult the Xen Project community's agreed Security Policy:
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
-----END PGP SIGNATURE-----
Xenproject.org Security Team