SB2020071325 - Debian update for xen

Description

This security bulletin contains information about 10 secuirty vulnerabilities.

1) Buffer overflow (CVE-ID: CVE-2020-11739)

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

An issue was discovered in Xen through 4.13.x, allowing guest OS users to cause a denial of service or possibly gain privileges because of missing memory barriers in read-write unlock paths. The read-write unlock paths don't contain a memory barrier. On Arm, this means a processor is allowed to re-order the memory access with the preceding ones. In other words, the unlock may be seen by another processor before all the memory accesses within the "critical" section. As a consequence, it may be possible to have a writer executing a critical section at the same time as readers or another writer. In other words, many of the assumptions (e.g., a variable cannot be modified after a check) in the critical sections are not safe anymore. The read-write locks are used in hypercalls (such as grant-table ones), so a malicious guest could exploit the race. For instance, there is a small window where Xen can leak memory if XENMAPSPACE_grant_table is used concurrently. A malicious guest may be able to leak memory, or cause a hypervisor crash resulting in a Denial of Service (DoS).

2) Information disclosure (CVE-ID: CVE-2020-11740)

The vulnerability allows a remote user to gain access to potentially sensitive information.

An issue was discovered in xenoprof in Xen through 4.13.x, allowing guest OS users (without active profiling) to obtain sensitive information about other guests. Unprivileged guests can request to map xenoprof buffers, even if profiling has not been enabled for those guests.

3) Missing Authorization (CVE-ID: CVE-2020-11741)

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

An issue was discovered in xenoprof in Xen through 4.13.x, allowing guest OS users (with active profiling) to obtain sensitive information about other guests, cause a denial of service, or possibly gain privileges. For guests for which "active" profiling was enabled by the administrator, the xenoprof code uses the standard Xen shared ring structure. Unfortunately, this code did not treat the guest as a potential adversary: it trusts the guest not to modify buffer size information or modify head / tail pointers in unexpected ways. A remote user can perform a denial of service (DoS) attack.

4) Unchecked Return Value (CVE-ID: CVE-2020-11742)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to introduction of unexpected behavior in the fix for CVE-2017-1213 that caused bad continuation handling in GNTTABOP_copy. A remote user can crash the hypervisor.

5) Improper Handling of Exceptional Conditions (CVE-ID: CVE-2020-11743)

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

An issue was discovered in Xen through 4.13.x, allowing guest OS users to cause a denial of service because of a bad error path in GNTTABOP_map_grant. Grant table operations are expected to return 0 for success, and a negative number for errors. Some misplaced brackets cause one error path to return 1 instead of a negative value. The grant table code in Linux treats this condition as success, and proceeds with incorrectly initialised state. A buggy or malicious guest can construct its grant table in such a way that, when a backend domain tries to map a grant, it hits the incorrect error path. This will crash a Linux based dom0 or backend domain.

6) Untrusted Pointer Dereference (CVE-ID: CVE-2020-15563)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to inverted code paths in x86 dirty VRAM tracking in Xen. An attacker with access to HVM guest operating system can crash the hypervisor.

Note: the vulnerability affects x86 systems only.

7) Resource management error (CVE-ID: CVE-2020-15564)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to missing alignment check in VCPUOP_register_vcpu_info hypercall in Xen. A attacker with privileged access to guest operating system can crash the hypervisor.

Note: the vulnerability affects Arm systems only.

8) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2020-15565)

The vulnerability allows a remote attacker to escalate privileges on the system or perform a denial of service attack.

The vulnerability exists due to application does not properly impose security restrictions. When page tables are shared between IOMMU and CPU, changes to them require flushing of both TLBs. Furthermore, IOMMUs may be non-coherent, and hence prior to flushing IOMMU TLBs, a CPU cache also needs writing back to memory after changes were made. Such writing back of cached data was missing in particular when splitting large page mappings into smaller granularity ones. A malicious guest may be able to retain read/write DMA access to frames returned to Xen's free pool, and later reused for another purpose.

Successful exploitation of the vulnerability may allows privileges escalation on the host operating system.

Note: the vulnerability affects Intel x86 systems only.

9) Resource management error (CVE-ID: CVE-2020-15566)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling in event-channel port allocation in Xen. An attacker with access to guest operating system can consume more than 1023 event channels and crash the hypervisor.

10) Race condition (CVE-ID: CVE-2020-15567)

The vulnerability allows a remote attacker to escalate privileges on the system.

The vulnerability exists due to improper management of internal resources in Xen. When mapping guest EPT (nested paging) tables, Xen would in some circumstances use a series of non-atomic bitfield writes. Depending on the compiler version and optimisation flags, Xen might expose a dangerous partially written PTE to the hardware, which an attacker might be able to race to exploit. An attacker with access to guest operating system can perform a denial of service (DoS) attack or escalate privileges on the host operating system.

Note: the vulnerability can be exploited only on systems with Intel processors.

Remediation

Install update from vendor's website.

References

• https://www.debian.org/security/2020/dsa-4723