From owner-svn-ports-head@freebsd.org Mon Jul 4 19:02:28 2016 Return-Path: Delivered-To: svn-ports-head@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 6EBE2B913C1; Mon, 4 Jul 2016 19:02:28 +0000 (UTC) (envelope-from junovitch@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 43E2C296E; Mon, 4 Jul 2016 19:02:28 +0000 (UTC) (envelope-from junovitch@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id u64J2R2x033769; Mon, 4 Jul 2016 19:02:27 GMT (envelope-from junovitch@FreeBSD.org) Received: (from junovitch@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id u64J2RWJ033768; Mon, 4 Jul 2016 19:02:27 GMT (envelope-from junovitch@FreeBSD.org) Message-Id: <201607041902.u64J2RWJ033768@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: junovitch set sender to junovitch@FreeBSD.org using -f From: Jason Unovitch Date: Mon, 4 Jul 2016 19:02:27 +0000 (UTC) To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: svn commit: r418049 - head/security/vuxml X-SVN-Group: ports-head MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-ports-head@freebsd.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: SVN commit messages for the ports tree for head List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 04 Jul 2016 19:02:28 -0000 Author: junovitch Date: Mon Jul 4 19:02:26 2016 New Revision: 418049 URL: https://svnweb.freebsd.org/changeset/ports/418049 Log: Document Xen Security Advisories (XSAs 173, 175, 176, 178, 179, and 180). XSAs 171, 172, 174, and 181 are not applicable to FreeBSD. Discussed with: royger Security: CVE-2014-3672 Security: CVE-2016-3710 Security: CVE-2016-3712 Security: CVE-2016-4963 Security: CVE-2016-4480 Security: CVE-2016-4962 Security: CVE-2016-3960 Security: https://vuxml.FreeBSD.org/freebsd/e800cd4b-4212-11e6-942d-bc5ff45d0f28.html Security: https://vuxml.FreeBSD.org/freebsd/e6ce6f50-4212-11e6-942d-bc5ff45d0f28.html Security: https://vuxml.FreeBSD.org/freebsd/e589ae90-4212-11e6-942d-bc5ff45d0f28.html Security: https://vuxml.FreeBSD.org/freebsd/e43b210a-4212-11e6-942d-bc5ff45d0f28.html Security: https://vuxml.FreeBSD.org/freebsd/e2fca11b-4212-11e6-942d-bc5ff45d0f28.html Security: https://vuxml.FreeBSD.org/freebsd/d51ced72-4212-11e6-942d-bc5ff45d0f28.html Modified: head/security/vuxml/vuln.xml Modified: head/security/vuxml/vuln.xml ============================================================================== --- head/security/vuxml/vuln.xml Mon Jul 4 18:14:18 2016 (r418048) +++ head/security/vuxml/vuln.xml Mon Jul 4 19:02:26 2016 (r418049) @@ -58,6 +58,214 @@ Notes: * Do not forget port variants (linux-f10-libxml2, libxml2, etc.) --> + + xen-tools -- Unrestricted qemu logging + + + xen-tools + 4.7.0_2 + + + + +

The Xen Project reports:

+
When the libxl toolstack launches qemu for HVM guests, it pipes the + output of stderr to a file in /var/log/xen. This output is not + rate-limited in any way. The guest can easily cause qemu to print + messages to stderr, causing this file to become arbitrarily large. +
+
The disk containing the logfile can be exausted, possibly causing a + denial-of-service (DoS).
+

+ + + + CVE-2014-3672 + http://xenbits.xen.org/xsa/advisory-180.html + + + 2016-05-23 + 2016-07-04 + + + + + xen-tools -- QEMU: Banked access to VGA memory (VBE) uses inconsistent bounds checks + + + xen-tools + 4.7.0_2 + + + + +

The Xen Project reports:

+
Qemu VGA module allows banked access to video memory using the + window at 0xa00000 and it supports different access modes with + different address calculations.
+
Qemu VGA module allows guest to edit certain registers in 'vbe' + and 'vga' modes.
+
A privileged guest user could use CVE-2016-3710 to exceed the bank + address window and write beyond the said memory area, potentially + leading to arbitrary code execution with privileges of the Qemu + process. If the system is not using stubdomains, this will be in + domain 0.
+
A privileged guest user could use CVE-2016-3712 to cause potential + integer overflow or OOB read access issues in Qemu, resulting in a DoS + of the guest itself. More dangerous effect, such as data leakage or + code execution, are not known but cannot be ruled out.
+

+ + + + CVE-2016-3710 + CVE-2016-3712 + http://xenbits.xen.org/xsa/advisory-179.html + + + 2016-05-09 + 2016-07-04 + + + + + xen-tools -- Unsanitised driver domain input in libxl device handling + + + xen-tools + 4.7.0_1 + + + + +

The Xen Project reports:

+
libxl's device-handling code freely uses and trusts information + from the backend directories in xenstore.
+
A malicious driver domain can deny service to management tools.
+

+ + + + CVE-2016-4963 + http://xenbits.xen.org/xsa/advisory-178.html + + + 2016-06-02 + 2016-07-04 + + + + + xen-kernel -- x86 software guest page walk PS bit handling flaw + + + xen-kernel + 4.7.0 + + + + +

The Xen Project reports:

+
The Page Size (PS) page table entry bit exists at all page table + levels other than L1. Its meaning is reserved in L4, and + conditionally reserved in L3 and L2 (depending on hardware + capabilities). The software page table walker in the hypervisor, + however, so far ignored that bit in L4 and (on respective hardware) + L3 entries, resulting in pages to be treated as page tables which + the guest OS may not have designated as such. If the page in + question is writable by an unprivileged user, then that user will + be able to map arbitrary guest memory.
+
On vulnerable OSes, guest user mode code may be able to establish + mappings of arbitrary memory inside the guest, allowing it to + elevate its privileges inside the guest.
+

+ + + + CVE-2016-4480 + http://xenbits.xen.org/xsa/advisory-176.html + + + 2016-05-17 + 2016-07-04 + + + + + xen-tools -- Unsanitised guest input in libxl device handling code + + + xen-tools + 4.7.0_1 + + + + +

The Xen Project reports:

+
Various parts of libxl device-handling code inappropriately use + information from (partially) guest controlled areas of xenstore.
+
A malicious guest administrator can cause denial of service by + resource exhaustion.
+
A malicious guest administrator can confuse and/or deny service to + management facilities.
+
A malicious guest administrator of a guest configured with channel + devices may be able to escalate their privilege to that of the + backend domain (i.e., normally, to that of the host).
+

+ + + + CVE-2016-4962 + http://xenbits.xen.org/xsa/advisory-175.html + + + 2016-06-02 + 2016-07-04 + + + + + xen-kernel -- x86 shadow pagetables: address width overflow + + + xen-kernel + 3.44.7.0 + + + + +

The Xen Project reports:

+
In the x86 shadow pagetable code, the guest frame number of a + superpage mapping is stored in a 32-bit field. If a shadowed guest + can cause a superpage mapping of a guest-physical address at or + above 2^44 to be shadowed, the top bits of the address will be lost, + causing an assertion failure or NULL dereference later on, in code + that removes the shadow.
+
A HVM guest using shadow pagetables can cause the host to crash. +
+
A PV guest using shadow pagetables (i.e. being migrated) with PV + superpages enabled (which is not the default) can crash the host, or + corrupt hypervisor memory, and so a privilege escalation cannot be + ruled out.
+

+ + + + CVE-2016-3960 + http://xenbits.xen.org/xsa/advisory-173.html + + + 2016-04-18 + 2016-07-04 + + + wireshark -- multiple vulnerabilities