Date: Tue, 2 Aug 2016 02:07:56 +0000 (UTC) From: Jason Unovitch <junovitch@FreeBSD.org> To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: svn commit: r419463 - head/security/vuxml Message-ID: <201608020207.u7227u6A000490@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: junovitch Date: Tue Aug 2 02:07:56 2016 New Revision: 419463 URL: https://svnweb.freebsd.org/changeset/ports/419463 Log: Document Xen Security Advisories (XSAs 182, 183, and 184) PR: 211482 Security: CVE-2016-5403 Security: CVE-2016-6259 Security: CVE-2016-6258 Security: https://vuxml.FreeBSD.org/freebsd/06574c62-5854-11e6-b334-002590263bf5.html Security: https://vuxml.FreeBSD.org/freebsd/04cf89e3-5854-11e6-b334-002590263bf5.html Security: https://vuxml.FreeBSD.org/freebsd/032aa524-5854-11e6-b334-002590263bf5.html Modified: head/security/vuxml/vuln.xml Modified: head/security/vuxml/vuln.xml ============================================================================== --- head/security/vuxml/vuln.xml Mon Aug 1 23:28:21 2016 (r419462) +++ head/security/vuxml/vuln.xml Tue Aug 2 02:07:56 2016 (r419463) @@ -58,6 +58,105 @@ Notes: * Do not forget port variants (linux-f10-libxml2, libxml2, etc.) --> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">; + <vuln vid="06574c62-5854-11e6-b334-002590263bf5"> + <topic>xen-tools -- virtio: unbounded memory allocation issue</topic> + <affects> + <package> + <name>xen-tools</name> + <range><lt>4.7.0_4</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml">; + <p>The Xen Project reports:</p> + <blockquote cite="http://xenbits.xen.org/xsa/advisory-184.html">; + <p>A guest can submit virtio requests without bothering to wait for + completion and is therefore not bound by virtqueue size...</p> + <p>A malicious guest administrator can cause unbounded memory + allocation in QEMU, which can cause an Out-of-Memory condition + in the domain running qemu. Thus, a malicious guest administrator + can cause a denial of service affecting the whole host.</p> + </blockquote> + </body> + </description> + <references> + <cvename>CVE-2016-5403</cvename> + <freebsdpr>ports/211482</freebsdpr> + <url>http://xenbits.xen.org/xsa/advisory-184.html</url>; + </references> + <dates> + <discovery>2016-07-27</discovery> + <entry>2016-08-02</entry> + </dates> + </vuln> + + <vuln vid="04cf89e3-5854-11e6-b334-002590263bf5"> + <topic>xen-kernel -- x86: Missing SMAP whitelisting in 32-bit exception / event delivery</topic> + <affects> + <package> + <name>xen-kernel</name> + <range><gt>4.5</gt><lt>4.7.0_3</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml">; + <p>The Xen Project reports:</p> + <blockquote cite="http://xenbits.xen.org/xsa/advisory-183.html">; + <p>Supervisor Mode Access Prevention is a hardware feature designed + to make an Operating System more robust, by raising a pagefault + rather than accidentally following a pointer into userspace. + However, legitimate accesses into userspace require whitelisting, + and the exception delivery mechanism for 32bit PV guests wasn't + whitelisted.</p> + <p>A malicious 32-bit PV guest kernel can trigger a safety check, + crashing the hypervisor and causing a denial of service to other + VMs on the host.</p> + </blockquote> + </body> + </description> + <references> + <cvename>CVE-2016-6259</cvename> + <freebsdpr>ports/211482</freebsdpr> + <url>http://xenbits.xen.org/xsa/advisory-183.html</url>; + </references> + <dates> + <discovery>2016-07-26</discovery> + <entry>2016-08-02</entry> + </dates> + </vuln> + + <vuln vid="032aa524-5854-11e6-b334-002590263bf5"> + <topic>xen-kernel -- x86: Privilege escalation in PV guests</topic> + <affects> + <package> + <name>xen-kernel</name> + <range><lt>4.7.0_3</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml">; + <p>The Xen Project reports:</p> + <blockquote cite="http://xenbits.xen.org/xsa/advisory-182.html">; + <p>The PV pagetable code has fast-paths for making updates to + pre-existing pagetable entries, to skip expensive re-validation + in safe cases (e.g. clearing only Access/Dirty bits). The bits + considered safe were too broad, and not actually safe.</p> + <p>A malicous PV guest administrator can escalate their privilege to + that of the host.</p> + </blockquote> + </body> + </description> + <references> + <cvename>CVE-2016-6258</cvename> + <freebsdpr>ports/211482</freebsdpr> + <url>http://xenbits.xen.org/xsa/advisory-182.html</url>; + </references> + <dates> + <discovery>2016-07-26</discovery> + <entry>2016-08-02</entry> + </dates> + </vuln> + <vuln vid="cb5189eb-572f-11e6-b334-002590263bf5"> <topic>libidn -- mulitiple vulnerabilities</topic> <affects>
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201608020207.u7227u6A000490>