CVE-2015-3340

This xen update is based on upstream 4.5.2 maintenance release, and fixes the following security issues:

The vgic_v2_to_sgi function in arch/arm/vgic-v2.c in Xen 4.5.x, when running on ARM hardware with general interrupt controller (GIC) version 2, allows local guest users to cause a denial of service (host crash) by writing an invalid value to the GICD.SGIR register (CVE-2015-0268).

The ARM GIC distributor virtualization in Xen 4.4.x and 4.5.x allows local guests to cause a denial of service by causing a large number messages to be logged (CVE-2015-1563).

The emulation routines for unspecified X86 devices in Xen 3.2.x through 4.5.x does not properly initialize data, which allow local HVM guest users to obtain sensitive information via vectors involving an unsupported access size (CVE-2015-2044).

The HYPERVISOR_xen_version hypercall in Xen 3.2.x through 4.5.x does not properly initialize data structures, which allows local guest users to obtain sensitive information via unspecified vectors (CVE-2015-2045).

Xen 3.3.x through 4.5.x and the Linux kernel through 3.19.1 do not properly restrict access to PCI command registers, which might allow local guest users to cause a denial of service (non-maskable interrupt and host crash) by disabling the (1) memory or (2) I/O decoding for a PCI Express device and then accessing the device, which triggers an Unsupported Request (UR) response (CVE-2015-2150).

The x86 emulator in Xen 3.2.x through 4.5.x does not properly ignore segment overrides for instructions with register operands, which allows local guest users to obtain sensitive information, cause a denial of service (memory corruption), or possibly execute arbitrary code via unspecified vectors (CVE-2015-2151).

Xen 4.5.x and earlier enables certain default backends when emulating a VGA device for an x86 HVM guest qemu even when the configuration disables them, which allows local guest users to obtain access to the VGA console by (1) setting the DISPLAY environment variable, when compiled with SDL support, or connecting to the VNC server on (2) ::1 or (3) 127.0.0.1, when not compiled with SDL support (CVE-2015-2152).

Xen 4.3.x, 4.4.x, and 4.5.x, when using toolstack disaggregation, allows remote domains with partial management control to cause a denial of service (host lock) via unspecified domctl operations (CVE-2015-2751).

The XEN_DOMCTL_memory_mapping hypercall in Xen 3.2.x through 4.5.x, when using a PCI passthrough device, is not preemptable, which allows local x86 HVM domain users to cause a denial of service (host CPU consumption) via a crafted request to the device model (qemu-dm) (CVE-2015-2752).

QEMU, as used in Xen 3.3.x through 4.5.x, does not properly restrict access to PCI command registers, which might allow local HVM guest users to cause a denial of service (non-maskable interrupt and host crash) by disabling the (1) memory or (2) I/O decoding for a PCI Express device and then accessing the device, which triggers an Unsupported Request (UR) response (CVE-2015-2756).

Heap-based buffer overflow in the PCNET controller in QEMU allows remote attackers to execute arbitrary code by sending a packet with TXSTATUS_STARTPACKET set and then a crafted packet with TXSTATUS_DEVICEOWNS set (CVE-2015-3209).

Stack-based buffer overflow in the xl command line utility in Xen 4.1.x through 4.5.x allows local guest administrators to gain privileges via a long configuration argument (CVE-2015-3259).

Xen 4.2.x through 4.5.x does not initialize certain fields, which allows certain remote service domains to obtain sensitive information from memory via a (1) XEN_DOMCTL_gettscinfo or (2) XEN_SYSCTL_getdomaininfolist request (CVE-2015-3340).

The Floppy Disk Controller (FDC) in QEMU, as used in Xen 4.5.x and earlier and KVM, allows local guest users to cause a denial of service (out-of-bounds write and guest crash) or possibly execute arbitrary code via the (1) FD_CMD_READ_ID, (2) FD_CMD_DRIVE_SPECIFICATION_COMMAND, or other…

These are all security issues fixed in the xen-4.7.0_12-1.3 package on the GA media of openSUSE Tumbleweed.

XEN was updated to fix two security issues and bugs.

Security issues fixed:

• CVE-2015-3340: Xen did not initialize certain fields, which allowed certain remote service domains to obtain sensitive information from memory via a (1) XEN_DOMCTL_gettscinfo or (2) XEN_SYSCTL_getdomaininfolist request.

• CVE-2015-2751: Xen, when using toolstack disaggregation, allowed remote domains with partial management control to cause a denial of service (host lock) via unspecified domctl operations.

• CVE-2015-2752: The XEN_DOMCTL_memory_mapping hypercall in Xen, when using a PCI passthrough device, was not preemptable, which allowed local x86 HVM domain users to cause a denial of service (host CPU consumption) via a crafted request to the device model (qemu-dm).

• CVE-2015-3456: Fixed a buffer overflow in the floppy drive emulation, which could be used to denial of service attacks or potential code execution against the host.

Bugs fixed:

• xentop: Fix memory leak on read failure

This update fixes the following security issues in Xen:

* CVE-2012-5510: Grant table version switch list corruption
  vulnerability (XSA-26)
* CVE-2012-5511: Several HVM operations do not validate the range of
  their inputs (XSA-27)
* CVE-2012-5513: XENMEM_exchange may overwrite hypervisor memory
  (XSA-29)
* CVE-2012-5514: Missing unlock in
  guest_physmap_mark_populate_on_demand() (XSA-30)
* CVE-2012-5515: Several memory hypercall operations allow invalid
  extent order values (XSA-31)

Also the following fix has been applied:

* bnc#777628 - guest 'disappears' after live migration
  Updated block-dmmd script

Security Issues references:

* CVE-2012-5513
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5513>
* CVE-2012-5514
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5514>
* CVE-2012-5511
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5511>
* CVE-2012-5510
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5510>
* CVE-2012-5515
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5515>

XEN has been updated to fix various bugs and security issues:

* 

  CVE-2013-0153: (XSA 36) To avoid an erratum in early hardware, the
  Xen AMD IOMMU code by default choose to use a single interrupt
  remapping table for the whole system. This sharing implied that any
  guest with a passed through PCI device that is bus mastering capable
  can inject interrupts into other guests, including domain 0. This has
  been disabled for AMD chipsets not capable of it.

* 

  CVE-2012-6075: qemu: The e1000 had overflows under some conditions,
  potentially corrupting memory.

* 

  CVE-2013-0154: (XSA 37) Hypervisor crash due to incorrect ASSERT
  (debug build only)

* 

  CVE-2012-5634: (XSA-33) A VT-d interrupt remapping source validation
  flaw was fixed.

Also the following bugs have been fixed:

* bnc#805094 - xen hot plug attach/detach fails
* bnc#802690 - domain locking can prevent a live migration from
  completing
* bnc#797014 - no way to control live migrations
      o fix logic error in stdiostream_progress
      o restore logging in xc_save
      o add options to control migration tunables
* bnc#806736: enabling xentrace crashes hypervisor
* Upstream patches from Jan 26287-sched-credit-pick-idle.patch
  26501-VMX-simplify-CR0-update.patch
  26502-VMX-disable-SMEP-when-not-paging.patch
  26516-ACPI-parse-table-retval.patch (Replaces
  CVE-2013-0153-xsa36.patch) 26517-AMD-IOMMU-clear-irtes.patch
  (Replaces CVE-2013-0153-xsa36.patch)
  26518-AMD-IOMMU-disable-if-SATA-combined-mode.patch (Replaces
  CVE-2013-0153-xsa36.patch)
  26519-AMD-IOMMU-perdev-intremap-default.patch (Replaces
  CVE-2013-0153-xsa36.patch) 26526-pvdrv-no-devinit.patch
  26531-AMD-IOMMU-IVHD-special-missing.patch (Replaces
  CVE-2013-0153-xsa36.patch)
* bnc#798188 - Add $network to xend initscript dependencies
* bnc#799694 - Unable to dvd or cdrom-boot DomU after xen-tools update
  Fixed with update to Xen version 4.1.4
* bnc#800156 - L3: HP iLo Generate NMI function not working in XEN
  kernel
* Upstream patches from Jan 26404-x86-forward-both-NMI-kinds.patch
  26427-x86-AMD-enable-WC+.patch
* bnc#793927 - Xen VMs with more than 2 disks randomly fail to start
* Upstream patches from Jan 26332-x86-compat-show-guest-stack-mfn.patch
  26333-x86-get_page_type-assert.patch (Replaces
  CVE-2013-0154-xsa37.patch)
  26340-VT-d-intremap-verify-legacy-bridge.patch (Replaces
  CVE-2012-5634-xsa33.patch) 26370-libxc-x86-initial-mapping-fit.patch
* Update to Xen 4.1.4 c/s 23432
* Update xenpaging.guest-memusage.patch add rule for xenmem to avoid
  spurious build failures
* Upstream patches from Jan 26179-PCI-find-next-cap.patch
  26183-x86-HPET-masking.patch 26188-x86-time-scale-asm.patch
  26200-IOMMU-debug-verbose.patch 26203-x86-HAP-dirty-vram-leak.patch
  26229-gnttab-version-switch.patch (Replaces
  CVE-2012-5510-xsa26.patch) 26230-x86-HVM-limit-batches.patch
  (Replaces CVE-2012-5511-xsa27.patch)
  26231-memory-exchange-checks.patch (Replaces
  CVE-2012-5513-xsa29.patch) 26232-x86-mark-PoD-error-path.patch
  (Replaces CVE-2012-5514-xsa30.patch) 26233-memop-order-checks.patch
  (Replaces CVE-2012-5515-xsa31.patch)
  26235-IOMMU-ATS-max-queue-depth.patch
  26272-x86-EFI-makefile-cflags-filter.patch
  26294-x86-AMD-Fam15-way-access-filter.patch CVE-2013-0154-xsa37.patch
* Restore c/s 25751 in 23614-x86_64-EFI-boot.patch. Modify the EFI
  Makefile to do additional filtering.

Security Issue references:

* CVE-2013-0153
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0153>
* CVE-2012-6075
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6075>
* CVE-2012-5634
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5634>

Xen 4.2.x through 4.5.x does not initialize certain fields, which allows certain remote service domains to obtain sensitive information from memory via a (1) XEN_DOMCTL_gettscinfo or (2) XEN_SYSCTL_getdomaininfolist request.