Filesadvisory-196.txt (signed advisory file)
-----BEGIN PGP SIGNED MESSAGE-----
Xen Security Advisory CVE-2016-9377,CVE-2016-9378 / XSA-196
x86 software interrupt injection mis-handled
UPDATES IN VERSION 3
There are two closely-related bugs.
When Xen emulates instructions which generate software interrupts it
needs to perform a privilege check involving an IDT lookup. This
check is sometimes erroneously conducted as if the IDT had the format
for a 32-bit guest, when in fact it is in the 64-bit format. Xen will
then read the wrong part of the IDT and interpret it in an unintended
When Xen emulates instructions which generate software interrupts, and
chooses to deliver the software interrupt, it may try to use the
method intended for injecting exceptions. This is incorrect, and
results in a guest crash. (CVE-2016-9378)
These instructions are not ususally handled by the emulator.
Exploiting the bug requires ability to force use of the emulator.
An unprivileged guest user program may be able to crash the guest.
Xen versions 4.5 and newer are vulnerable. Older versions are not
The vulnerability is only exposed on AMD hardware lacking the NRip
feature. AMD hardware with the NRip feature, and all Intel hardware,
is not vulnerable.
Xen prints information about CPU features on boot. If you see this:
(XEN) SVM: Supported advanced features:
(XEN) - Next-RIP Saved on #VMEXIT
then you are not vulnerable because you have an AMD CPU with NRip.
If you see this:
(XEN) VMX: Supported advanced features:
then you are not vulnerable because you have an Intel CPU.
The vulnerability is only exposed on HVM guests.
ARM systems are NOT vulnerable.
Running only PV guests will avoid this issue.
This issue was discovered by Andrew Cooper of Citrix.
Applying the attached patches resolves this issue.
xsa196-000*.patch xen-unstable, Xen 4.7.x, Xen 4.6.x, Xen 4.5.x
$ sha256sum xsa196*
DEPLOYMENT DURING EMBARGO
Deployment of the patches and/or mitigations described above (or
others which are substantially similar) is permitted during the
embargo, even on public-facing systems with untrusted guest users and
But: Distribution of updated software is prohibited (except to other
members of the predisclosure list).
Predisclosure list members who wish to deploy significantly different
patches and/or mitigations, please contact the Xen Project Security
(Note: this during-embargo deployment notice is retained in
post-embargo publicly released Xen Project advisories, even though it
is then no longer applicable. This is to enable the community to have
oversight of the Xen Project Security Team's decisionmaking.)
For more information about permissible uses of embargoed information,
consult the Xen Project community's agreed Security Policy:
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
-----END PGP SIGNATURE-----
Xenproject.org Security Team