-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

            Xen Security Advisory CVE-2018-19963 / XSA-276
                              version 3

        resource accounting issues in x86 IOREQ server handling

UPDATES IN VERSION 3
====================

CVE assigned.

ISSUE DESCRIPTION
=================

Allocation of pages used to communicate with external emulators did not
follow certain principles that are required for proper life cycle
management of guest exposed pages.

IMPACT
======

A compromised DM stubdomain may cause Xen to crash, resulting in a DoS
(Denial of Service) affecting the entire host.  Privilege escalation
as well as information leaks cannot be ruled out.

VULNERABLE SYSTEMS
==================

Only Xen 4.11 is affected by this vulnerability.  Xen 4.10 and older are
not affected by this vulnerability.

Only systems running HVM guests with their devicemodels in a
stubdomain are considered vulnerable.  Note that attackers also need
to exploit the devicemodel in order to have access to this
vulnerability.

Arm guests cannot leverage this vulnerability.

MITIGATION
==========

Running only PV guests will avoid this vulnerability.

(The security of a Xen system using stub domains is still better than
with a qemu-dm running as an unrestricted dom0 process.  Therefore
users with these configurations should not switch to an unrestricted
dom0 qemu-dm.)

CREDITS
=======

This issue was discovered by Julien Grall of ARM.

RESOLUTION
==========

Applying the appropriate set of attached patches resolves this issue.

xsa276/*.patch           xen-unstable
xsa276-4.11/*.patch        Xen 4.11.x

$ sha256sum xsa276* xsa276*/*
efe9f031c5646b111cbfbe35141a7d99eb31ead07c1c6051145abbd9a3def5b9  xsa276.meta
7f77225e3de780a2507714caab5870664634bf9f76215547bebd31a6399a86ef  xsa276-4.11/0001-x86-hvm-ioreq-fix-page-referencing.patch
c93c66090009833cd11fabe72b523cbdb3467fa104cc97d1855d365881aa7f8e  xsa276-4.11/0002-x86-hvm-ioreq-use-ref-counted-target-assigned-shared.patch
ef8b89375866821f4a612f600d10834bf65d811b1784a4ee0fde4a3a409501e0  xsa276/0001-x86-hvm-ioreq-fix-page-referencing.patch
75398ec343b9aaebf0c7dc0c5ef5ed7a3f3be0959f1519db5c7f32c44e7a54d3  xsa276/0002-x86-hvm-ioreq-use-ref-counted-target-assigned-shared.patch
$

DEPLOYMENT DURING EMBARGO
=========================

Deployment of the patches and/or mitigations described above (or
others which are substantially similar) is permitted during the
embargo, even on public-facing systems with untrusted guest users and
administrators.

But: Distribution of updated software is prohibited (except to other
members of the predisclosure list).

Predisclosure list members who wish to deploy significantly different
patches and/or mitigations, please contact the Xen Project Security
Team.

(Note: this during-embargo deployment notice is retained in
post-embargo publicly released Xen Project advisories, even though it
is then no longer applicable.  This is to enable the community to have
oversight of the Xen Project Security Team's decisionmaking.)

For more information about permissible uses of embargoed information,
consult the Xen Project community's agreed Security Policy:
  http://www.xenproject.org/security-policy.html
-----BEGIN PGP SIGNATURE-----

iQFABAEBCAAqFiEEI+MiLBRfRHX6gGCng/4UyVfoK9kFAlw00y0MHHBncEB4ZW4u
b3JnAAoJEIP+FMlX6CvZcpAH/3AuQ0b6D3duO1/p1wHhNGwGOLf4uCIH85h+J1Vx
TRh77PtztIxosC4OtLObcOtLqf2qUH8SBXnKGiWeyDSjkS1ff8BCRbI8o6xdbvZz
wvuMZMoRjIjGqHmVQtI4Jmm260RdmQKeiWZydq0XTKp80oI8hqsid84eY0xDXYKi
GFjream7Vr93RuvhJelTRJGnZrVa630FlI8E8aI2BYrFKW2BaCXxBs6ZQY0UBhXM
rjqfSj4Ws640B8Sk2Shi8UNGI2rm+kF83s3VlXodGNDjOapXD8bYRp7UcxjnZ+R2
dLSFKdiwZ8598x82WhGn4J464l0tnmGQ6WaH08ZwM1xZD5U=
=Df4x
-----END PGP SIGNATURE-----