Xen Security Advisories (XSA-182 & XSA-183)

An update for Xen was just released to address two major security vulnerabilities and it is recommended that you update as soon as possible.

Issue 1:

The PV pagetable code has fast-paths for making updates to pre-existing pagetable entries, to skip expensive re-validation in safe cases (e.g. clearing only Access/Dirty bits). The bits considered safe were too broad, and not actually safe.

A malicous PV guest administrator can escalate their privilege to that of the host.

Issue 2:

Supervisor Mode Access Prevention is a hardware feature designed to make an Operating System more robust, by raising a pagefault rather than accidentally following a pointer into userspace. However, legitimate accesses into userspace require whitelisting, and the exception delivery mechanism for 32bit PV guests wasn’t whitelisted.

A malicious 32-bit PV guest kernel can trigger a safety check, crashing the hypervisor and causing a denial of service to other VMs on the host.

Source: Hostingseclist

Related Posts