-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Xen Security Advisory CVE-2019-19583 / XSA-308 version 4 VMX: VMentry failure with debug exceptions and blocked states UPDATES IN VERSION 4 ==================== Canonicalize version range for better parsing. ISSUE DESCRIPTION ================= Please see XSA-260 for background on the MovSS shadow: http://xenbits.xen.org/xsa/advisory-260.html Please see XSA-156 for background on the need for #DB interception: http://xenbits.xen.org/xsa/advisory-156.html The VMX VMEntry checks does not like the exact combination of state which occurs when #DB in intercepted, Single Stepping is active, and blocked by STI/MovSS is active, despite this being a legitimate state to be in. The resulting VMEntry failure is fatal to the guest. IMPACT ====== HVM/PVH guest userspace code may be able to crash the guest, resulting in a guest Denial of Service. VULNERABLE SYSTEMS ================== All versions of Xen are affected. Only systems supporting VMX hardware virtual extensions (Intel, Cyrix or Zhaoxin CPUs) are affected. Arm and AMD systems are unaffected. Only HVM/PVH guests are affected. PV guests cannot leverage the vulnerability. MITIGATION ========== Running only PV guests will avoid this vulnerability. Running HVM guests on only AMD hardware will also avoid this vulnerability. CREDITS ======= This issue was discovered by HÃ¥kon Alstadheim and diagnosed as a security issue by Andrew Cooper of Citrix. RESOLUTION ========== Applying the attached patch resolves this issue. xsa308.patch xen-unstable, Xen 4.13.x - Xen 4.8.x $ sha256sum xsa308* 4aa06d21478d9debb12388ff14d8abc31982e18895db40d0cec78fcc9fe68ef2 xsa308.meta 7e782b09b16f7534c8db52042f7bb3bd730d108571c8b10af184ae0b02fdae9d xsa308.patch $ DEPLOYMENT DURING EMBARGO ========================= Deployment of the patches and/or mitigations described above (or others which are substantially similar) is permitted during the embargo, even on public-facing systems with untrusted guest users and administrators. But: Distribution of updated software is prohibited (except to other members of the predisclosure list). Predisclosure list members who wish to deploy significantly different patches and/or mitigations, please contact the Xen Project Security Team. -----BEGIN PGP SIGNATURE----- iQFABAEBCAAqFiEEI+MiLBRfRHX6gGCng/4UyVfoK9kFAl82wN0MHHBncEB4ZW4u b3JnAAoJEIP+FMlX6CvZtMcIAKvc3NnJBRMkDmlnyqK2G6gWmWjBh8YWyBu4cn9Z e+QV9+Zc4bzz/uTgRqh3fe+8/q3f2qRlVfnNF8PxcQTbpDFYuHwzjZEY0AB05ADj o/RpqBvEaPwZLLYoNkpx0fXcNL7esX7yDcV35ioh1bC5eI48X5jPy+SV5vdHtMk7 AX5rVqKRYPrRe2bbjAPBnYOoSWwCD2knsDfqvlhCMFhbz5pNW7Kfz75HMFhV/Wh5 nK6mTIhFl3g6BCl/iVjAyQ4RU1IWwgmChoPamPFiDnsQZLFGCR+JlDlOP/fgYUmI YIlDpcfLp2KOhvcRlUGfawx+/onPgheKMgrnySlo6QFN33g= =Mskp -----END PGP SIGNATURE-----