svn commit: r419463 - head/security/vuxml
Jason Unovitch
junovitch at FreeBSD.org
Tue Aug 2 02:07:57 UTC 2016
Author: junovitch
Date: Tue Aug 2 02:07:56 2016
New Revision: 419463
URL: https://svnweb.freebsd.org/changeset/ports/419463
Log:
Document Xen Security Advisories (XSAs 182, 183, and 184)
PR: 211482
Security: CVE-2016-5403
Security: CVE-2016-6259
Security: CVE-2016-6258
Security: https://vuxml.FreeBSD.org/freebsd/06574c62-5854-11e6-b334-002590263bf5.html
Security: https://vuxml.FreeBSD.org/freebsd/04cf89e3-5854-11e6-b334-002590263bf5.html
Security: https://vuxml.FreeBSD.org/freebsd/032aa524-5854-11e6-b334-002590263bf5.html
Modified:
head/security/vuxml/vuln.xml
Modified: head/security/vuxml/vuln.xml
==============================================================================
--- head/security/vuxml/vuln.xml Mon Aug 1 23:28:21 2016 (r419462)
+++ head/security/vuxml/vuln.xml Tue Aug 2 02:07:56 2016 (r419463)
@@ -58,6 +58,105 @@ Notes:
* Do not forget port variants (linux-f10-libxml2, libxml2, etc.)
-->
<vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
+ <vuln vid="06574c62-5854-11e6-b334-002590263bf5">
+ <topic>xen-tools -- virtio: unbounded memory allocation issue</topic>
+ <affects>
+ <package>
+ <name>xen-tools</name>
+ <range><lt>4.7.0_4</lt></range>
+ </package>
+ </affects>
+ <description>
+ <body xmlns="http://www.w3.org/1999/xhtml">
+ <p>The Xen Project reports:</p>
+ <blockquote cite="http://xenbits.xen.org/xsa/advisory-184.html">
+ <p>A guest can submit virtio requests without bothering to wait for
+ completion and is therefore not bound by virtqueue size...</p>
+ <p>A malicious guest administrator can cause unbounded memory
+ allocation in QEMU, which can cause an Out-of-Memory condition
+ in the domain running qemu. Thus, a malicious guest administrator
+ can cause a denial of service affecting the whole host.</p>
+ </blockquote>
+ </body>
+ </description>
+ <references>
+ <cvename>CVE-2016-5403</cvename>
+ <freebsdpr>ports/211482</freebsdpr>
+ <url>http://xenbits.xen.org/xsa/advisory-184.html</url>
+ </references>
+ <dates>
+ <discovery>2016-07-27</discovery>
+ <entry>2016-08-02</entry>
+ </dates>
+ </vuln>
+
+ <vuln vid="04cf89e3-5854-11e6-b334-002590263bf5">
+ <topic>xen-kernel -- x86: Missing SMAP whitelisting in 32-bit exception / event delivery</topic>
+ <affects>
+ <package>
+ <name>xen-kernel</name>
+ <range><gt>4.5</gt><lt>4.7.0_3</lt></range>
+ </package>
+ </affects>
+ <description>
+ <body xmlns="http://www.w3.org/1999/xhtml">
+ <p>The Xen Project reports:</p>
+ <blockquote cite="http://xenbits.xen.org/xsa/advisory-183.html">
+ <p>Supervisor Mode Access Prevention is a hardware feature designed
+ to make an Operating System more robust, by raising a pagefault
+ rather than accidentally following a pointer into userspace.
+ However, legitimate accesses into userspace require whitelisting,
+ and the exception delivery mechanism for 32bit PV guests wasn't
+ whitelisted.</p>
+ <p>A malicious 32-bit PV guest kernel can trigger a safety check,
+ crashing the hypervisor and causing a denial of service to other
+ VMs on the host.</p>
+ </blockquote>
+ </body>
+ </description>
+ <references>
+ <cvename>CVE-2016-6259</cvename>
+ <freebsdpr>ports/211482</freebsdpr>
+ <url>http://xenbits.xen.org/xsa/advisory-183.html</url>
+ </references>
+ <dates>
+ <discovery>2016-07-26</discovery>
+ <entry>2016-08-02</entry>
+ </dates>
+ </vuln>
+
+ <vuln vid="032aa524-5854-11e6-b334-002590263bf5">
+ <topic>xen-kernel -- x86: Privilege escalation in PV guests</topic>
+ <affects>
+ <package>
+ <name>xen-kernel</name>
+ <range><lt>4.7.0_3</lt></range>
+ </package>
+ </affects>
+ <description>
+ <body xmlns="http://www.w3.org/1999/xhtml">
+ <p>The Xen Project reports:</p>
+ <blockquote cite="http://xenbits.xen.org/xsa/advisory-182.html">
+ <p>The PV pagetable code has fast-paths for making updates to
+ pre-existing pagetable entries, to skip expensive re-validation
+ in safe cases (e.g. clearing only Access/Dirty bits). The bits
+ considered safe were too broad, and not actually safe.</p>
+ <p>A malicous PV guest administrator can escalate their privilege to
+ that of the host.</p>
+ </blockquote>
+ </body>
+ </description>
+ <references>
+ <cvename>CVE-2016-6258</cvename>
+ <freebsdpr>ports/211482</freebsdpr>
+ <url>http://xenbits.xen.org/xsa/advisory-182.html</url>
+ </references>
+ <dates>
+ <discovery>2016-07-26</discovery>
+ <entry>2016-08-02</entry>
+ </dates>
+ </vuln>
+
<vuln vid="cb5189eb-572f-11e6-b334-002590263bf5">
<topic>libidn -- mulitiple vulnerabilities</topic>
<affects>
More information about the svn-ports-all
mailing list