|Public release ||2017-02-21 10:42|
|Updated ||2017-02-23 15:52|
|Title ||cirrus_bitblt_cputovideo does not check if memory region is safe|
Filesadvisory-209.txt (signed advisory file)
-----BEGIN PGP SIGNED MESSAGE-----
Xen Security Advisory CVE-2017-2620 / XSA-209
cirrus_bitblt_cputovideo does not check if memory region is safe
UPDATES IN VERSION 4
Include a prerequisite patch for qemu-upstream, correct statement
regarding the availability of a qemu-traditional patch.
In CIRRUS_BLTMODE_MEMSYSSRC mode the bitblit copy routine
cirrus_bitblt_cputovideo fails to check wethehr the specified memory
region is safe.
A malicious guest administrator can cause an out of bounds memory
write, very likely exploitable as a privilege escalation.
Versions of qemu shipped with all Xen versions are vulnerable.
Xen systems running on x86 with HVM guests, with the qemu process
running in dom0 are vulnerable.
Only guests provided with the "cirrus" emulated video card can exploit
the vulnerability. The non-default "stdvga" emulated video card is
not vulnerable. (With xl the emulated video card is controlled by the
"stdvga=" and "vga=" domain configuration options.)
ARM systems are not vulnerable. Systems using only PV guests are not
For VMs whose qemu process is running in a stub domain, a successful
attacker will only gain the privileges of that stubdom, which should
be only over the guest itself.
Both upstream-based versions of qemu (device_model_version="qemu-xen")
and `traditional' qemu (device_model_version="qemu-xen-traditional")
Running only PV guests will avoid the issue.
Running HVM guests with the device model in a stubdomain will mitigate
Changing the video card emulation to stdvga (stdvga=1, vga="stdvga",
in the xl domain configuration) will avoid the vulnerability.
This issue was discovered by Gerd Hoffmann of Red Hat.
Applying the appropriate attached patch resolves this issue.
xsa209-qemuu/*.patch qemu-xen, qemu upstream
$ sha256sum xsa209* xsa209*/*
DEPLOYMENT DURING EMBARGO
Deployment of the patches described above (or others which are
substantially similar) is permitted during the embargo, even on
public-facing systems with untrusted guest users and administrators.
However, deployment of the "stdvga" mitigation (changing the video
card emulation to stdvga) is NOT permitted (except where all the
affected systems and VMs are administered and used only by
organisations which are members of the Xen Project Security Issues
Predisclosure List). Specifically, deployment on public cloud systems
is NOT permitted. This is because this produces a guest-visible
change which will indicate which component contains the vulnerability.
Additionally, distribution of updated software is prohibited (except
to other members of the predisclosure list).
Predisclosure list members who wish to deploy significantly different
patches and/or mitigations, please contact the Xen Project Security
(Note: this during-embargo deployment notice is retained in
post-embargo publicly released Xen Project advisories, even though it
is then no longer applicable. This is to enable the community to have
oversight of the Xen Project Security Team's decisionmaking.)
For more information about permissible uses of embargoed information,
consult the Xen Project community's agreed Security Policy:
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
-----END PGP SIGNATURE-----
Xenproject.org Security Team