http://xenbits.xen.org/xsa/advisory-355.html

stack corruption from XSA-346 change

XSA-355 - Xen Security Advisories



InformationAdvisory XSA-355Public release 2020-11-24 12:00Updated 2020-11-24 12:03Version 2CVE(s) none (yet) assignedTitle stack corruption from XSA-346 changeFilesadvisory-355.txt (signed advisory file)xsa355.metaxsa355.patchAdvisory-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Xen Security Advisory XSA-355
version 2

stack corruption from XSA-346 change

UPDATES IN VERSION 2
====================

Added metadata file.

Public release.

ISSUE DESCRIPTION
=================

One of the two changes for XSA-346 introduced an on-stack array. The
check for guarding against overrunning this array was off by one,
allowing for corruption of the first stack slot immediately following
this array.

IMPACT
======

A malicious or buggy HVM or PVH guest can cause Xen to crash, resulting
in a Denial of Service (DoS) to the entire host. Privilege escalation
as well as information leaks cannot be excluded.

VULNERABLE SYSTEMS
==================

All Xen versions which have the patches for XSA-346 applied are
vulnerable.

Only x86 HVM and PVH guests can leverage the vulnerability. Arm guests
and x86 PV guests cannot leverage the vulnerability.

Only x86 HVM and PVH guests which have physical devices passed through
to them can leverage the vulnerability.

MITIGATION
==========

Not passing through physical devices to untrusted guests will avoid
the vulnerability.

CREDITS
=======

This issue was discovered by Jan Beulich of SUSE.

RESOLUTION
==========

Applying the attached patch resolves this issue.

Note that patches for released versions are generally prepared to
apply to the stable branches, and may not apply cleanly to the most
recent release tarball. Downstreams are encouraged to update to the
tip of the stable branch before applying these patches.

xsa355.patch xen-unstable - Xen 4.10.x

$ sha256sum xsa355*
a93bfc376897e7cffd095d395f1a66476adb9503d7d80a59b7861e64c2675323 xsa355.meta
dae633c11cf2eff3e304737265e18ab09213e8e4640458080a944ae7a40819a4 xsa355.patch
$

NOTE CONCERNING SHORT EMBARGO
=============================

This issue is likely to be re-discovered as the changes for XSA-346
are deployed more widely, since the issue is also triggerable without
any malice or bugginess.

DEPLOYMENT DURING EMBARGO
=========================

Deployment of the patches and/or mitigations described above (or
others which are substantially similar) is permitted during the
embargo, even on public-facing systems with untrusted guest users and
administrators.

But: Distribution of updated software is prohibited (except to other
members of the predisclosure list).

Predisclosure list members who wish to deploy significantly different
patches and/or mitigations, please contact the Xen Project Security
Team.

(Note: this during-embargo deployment notice is retained in
post-embargo publicly released Xen Project advisories, even though it
is then no longer applicable. This is to enable the community to have
oversight of the Xen Project Security Team's decisionmaking.)

For more information about permissible uses of embargoed information,
consult the Xen Project community's agreed Security Policy:
http://www.xenproject.org/security-policy.html
-----BEGIN PGP SIGNATURE-----

iQFABAEBCAAqFiEEI+MiLBRfRHX6gGCng/4UyVfoK9kFAl+89pEMHHBncEB4ZW4u
b3JnAAoJEIP+FMlX6CvZRHQH/1D8CfjZWYgLcdYOg6sDO6BIK8IsnAiOoe2C8b9i
M8QPFzHlUx09FI5CHVb0Va/pFliR1OS2tmmIU30DL9nmiDLcaP2uvpgJAYo5GwL5
Rzccjo4qbXwfSRQvHmLzbr+XN8sHDxbekpFd8T5WvuarUgxOaPCLTfSG0nag/t52
OVNIdDcP5lSt/Z88lYW75j4gBAsXUZDEXgn81JpeHj9js8YLFC3WFcwh58Jjd+hw
5DH955jNAKD8TRSy6uffDpvN1m9wm2vDGeXSUcJyswlV8Nqi6YRW4XO4Q6Cfj+CG
LVBS/T977JZGJjRvTw4j0H+xAXiLFwQ1I/6v6fSZzxDMt9k=
=+4M1
-----END PGP SIGNATURE-----
Xenproject.org Security Team

Xen 是一个开放源代码虚拟机监视器，由剑桥大学开发。它打算在单个计算机上运行多达100个满特征的操作系统。操作系统必须进行显式地修改（“移植”）以在Xen上运行（但是提供对用户应用的兼容性）。这使得Xen无需特殊硬件支持，就能达到高性能的虚拟化。

暂无

暂无