Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2022.2926
x86: MMIO Stale Data vulnerabilities
15 June 2022
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: Xen
Publisher: Xen
Operating System: Xen
Resolution: Patch/Upgrade
CVE Names: CVE-2022-25234 CVE-2022-21180 CVE-2022-21166
CVE-2022-21127 CVE-2022-21125 CVE-2022-21124
CVE-2022-21123
Original Bulletin:
http://xenbits.xen.org/xsa/advisory-404.html
Comment: CVSS (Max): 7.8 CVE-2022-21124 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS Source: [NVD], Red Hat, SUSE
Calculator: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Xen Security Advisory CVE-2022-21123,CVE-2022-21124,CVE-2022-21166 / XSA-404
x86: MMIO Stale Data vulnerabilities
ISSUE DESCRIPTION
=================
This issue is related to the SRBDS, TAA and MDS vulnerabilities. Please
see:
https://xenbits.xen.org/xsa/advisory-320.html (SRBDS)
https://xenbits.xen.org/xsa/advisory-305.html (TAA)
https://xenbits.xen.org/xsa/advisory-297.html (MDS)
Please see Intel's whitepaper:
https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/technical-documentation/processor-mmio-stale-data-vulnerabilities.html
IMPACT
======
An attacker might be able to directly read or infer data from other
security contexts in the system. This can include data belonging to
other VMs, or to Xen itself. The degree to which an attacker can obtain
data depends on the CPU, and the system configuration.
VULNERABLE SYSTEMS
==================
Systems running all versions of Xen are affected.
Only x86 processors are vulnerable. Processors from other manufacturers
(e.g. ARM) are not believed to be vulnerable.
Only Intel based processors are affected. Processors from other x86
manufacturers (e.g. AMD) are not believed to be vulnerable.
Please consult the Intel Security Advisory for details on the affected
processors and configurations.
Per Xen's support statement, PCI passthrough should be to trusted
domains because the overall system security depends on factors outside
of Xen's control.
As such, Xen, in a supported configuration, is not vulnerable to
DRPW/SBDR.
MITIGATION
==========
All mitigations depend on functionality added in the IPU 2022.1 (May
2022) microcode release from Intel. Consult your dom0 OS vendor.
To the best of the security team's understanding, the summary is as
follows:
Server CPUs (Xeon EP/EX, Scalable, and some Atom servers), excluding
Xeon E3 (which use the client CPU design), are potentially vulnerable to
DRPW (CVE-2022-21166).
Client CPUs (inc Xeon E3) are, furthermore, potentially vulnerable to
SBDR (CVE-2022-21123) and SBDS (CVE-2022-21125).
SBDS only affects CPUs vulnerable to MDS. On these CPUs, there are
previously undiscovered leakage channels. There is no change to the
existing MDS mitigations.
DRPW and SBDR only affects configurations where less privileged domains
have MMIO mappings of buggy endpoints. Consult your hardware vendor.
In configurations where less privileged domains have MMIO access to
buggy endpoints, `spec-ctrl=unpriv-mmio` can be enabled which will cause
Xen to mitigate cross-domain fill buffer leakage, and extend SRBDS
protections to protect RNG data from leakage.
RESOLUTION
==========
Applying the appropriate attached patch resolves this issue.
Note that patches for released versions are generally prepared to
apply to the stable branches, and may not apply cleanly to the most
recent release tarball. Downstreams are encouraged to update to the
tip of the stable branch before applying these patches.
The patches are still under review. An update will be sent once they
are reviewed and the backports are done.
xsa404/xsa404-.patch xen-unstable
$ sha256sum xsa404*/*
18b307c2cbbd08d568e9dcb2447901d94e22ff1e3945c3436173aa693f6456fb xsa404/xsa404-1.patch
d6f193ad963396285e983aa1c18539f67222582711fc62105c21b71b3b53a97d xsa404/xsa404-2.patch
d2c123ccdf5eb9f862d6e9cb0e59045ae18799a07db149c7d90e301ca20436aa xsa404/xsa404-3.patch
$
NOTE CONCERNING CVE-2022-21127 / Update to SRBDS
================================================
An issue was discovered with the SRBDS microcode mitigation. A
microcode update was released as part of Intel's IPU 2022.1 in May 2022.
Updating microcode is sufficient to fix the issue, with no extra actions
required on Xen's behalf. Consult your dom0 OS vendor or OEM for
updated microcode.
NOTE CONCERNING CVE-2022-21180 / Undefined MMIO Hang
====================================================
A related issue was discovered. See:
https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/advisory-guidance/undefined-mmio-hang.html
Xen is not vulnerable to UMH in supported configurations.
The only mitigation to is avoid passing impacted devices through to
untrusted guests.
- -----BEGIN PGP SIGNATURE-----
iQFABAEBCAAqFiEEI+MiLBRfRHX6gGCng/4UyVfoK9kFAmKo0Z0MHHBncEB4ZW4u
b3JnAAoJEIP+FMlX6CvZc8cH/RFgxQ4L8OewWMxsuowpgLg8NVyYGFMBgttscBh+
ANpjRTnV4yQGpt9nNFDAcXT1c/fvWhypOiwadEtczRl5k/Q96JOKFdiAc1QR35Oj
vmbCLgO20jQ/GdTzaqKUaGBwi8GLShJvH1zMPJ2KuXk5w5uFDhj2gEiB6Kdv9+9O
4FBxQkpDzll0gs5v16ien8btKhEuZj9lNtzXZw5j4+DJD69MvQqsRPVdEt+M17Ox
XGYcpfpLeGUaIUPFTPZDcFIJnMvqPBQyt+2eaeR2ezW2ouNpxepCSPsEDlAmSZ/K
uZA0ShyJD3pfCxjc8eztyF/4zajY5EvuEtWdUZC/3zVaUec=
=4EdA
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: https://auscert.org.au/gpg-key/
iQIVAwUBYqlUjskNZI30y1K9AQhQ2RAArHEZ/abAd5t4oQvlMMB3qRs1wfd/a145
gyhXDEFCU5xpJ3misp6rYSIWelJ4UW2x63c3ZcVBugpWcvwCLm/D/N8w7JT8pG39
JPu0I6+cheMumP/UWU97klR6BGIh6oivP0KKcvq3dbYUEeG32E6kZ2Dx7SyWBEZA
7Tb5FVT5brijEbd+GKfR7ME0h+PHNNOwvTo0YtM51C/jJTDoZHYRwbqkLcxeHHx6
Y58p6PMaVtUDGRPKMiJDHoZkPyi4o40tVhQX1DXURCloTnuXGlPaTs2CpcNqL+gj
+x5LwZhufzQLInHmA0DYiHOMNL+2Gp26LTYVWJF3VoixxarzOCvDFz6TdsczNZ1A
GUiKW9rJwGglBzXsNRokHKO09BGBVd8B5o46uP7Ukz9i24QxPTlnIx4cpC5cObCU
6zixVqgqgu86o1XIMeBY1vLuRgjmpCBRFnsmXYgvqn67nOyoTZ/ASfDyl0Uxa+vW
MkPMTAHcVNEuR0lsPMmiGf8evGIwL4lj4d+USuXtcy6H+vRNx1HsjxJ6Bb1tkKSc
VmvaJMg3QMiSWpEy2c/DyW69w37wwzhowysRKBW8lILaLtlNWpt4hbyBCCdglioh
M3ffBqcPRNQOwtutdW9+CgWkh4FQ/H49JZY5PaYV1gu4sbvunBNTpKb50/FvU1iQ
gZhjJu6NP4s=
=j7R9
-----END PGP SIGNATURE-----