XSA-108 Advisory • Hacker News Board

Re: XSA-108 Advisory

#11

Post by chippy » Wed, Oct 01, 2014, 12:39 PM UTC

Interesting that the patch is just one characters difference (applied in two locations)

0x3ff to 0xff

Re: XSA-108 Advisory

#12

Post by mzs » Wed, Oct 01, 2014, 12:43 PM UTC

alexduros wrote: post #7

interesting link ... from 2010 http://xen.1045712.n5.nabble.com/x2APIC-emulation-for-HVM-gu...

good find:

    @@ -2189,6 +2190,11 @@
             *msr_content = vcpu_vlapic(v)->hw.apic_base_msr;
             break;
     
    +    case MSR_IA32_APICBASE_MSR ... MSR_IA32_APICBASE_MSR + 0x3ff:
    +        if ( hvm_x2apic_msr_read(v, msr, msr_content) )
    +            goto gp_fault;
    +        break;
    +
         case MSR_IA32_CR_PAT:
             *msr_content = v->arch.hvm_vcpu.pat_cr;
             break;
    @@ -2296,6 +2302,11 @@
             vlapic_msr_set(vcpu_vlapic(v), msr_content);
             break;
     
    +    case MSR_IA32_APICBASE_MSR ... MSR_IA32_APICBASE_MSR + 0x3ff:
    +        if ( hvm_x2apic_msr_write(v, msr, msr_content) )
    +            goto gp_fault;
    +        break;
    +
         case MSR_IA32_CR_PAT:
             if ( !pat_msr_set(&v->arch.hvm_vcpu.pat_cr, msr_content) )
                goto gp_fault;

Re: XSA-108 Advisory

#13

Post by boardwaalk » Wed, Oct 01, 2014, 12:52 PM UTC

chippy wrote: post #11

Interesting that the patch is just one characters difference (applied in two locations) 0x3ff to 0xff

Seems to me like they should be using constants. Especially since this implies the 0xff/256 is elsewhere as well:

elsewhere a 256 rather than 1024 wide window is being used too

Re: XSA-108 Advisory

#14

Post by joosters » Wed, Oct 01, 2014, 12:53 PM UTC

sudowhodoido wrote: post #10

Well looks like Mr De Raadt was right again: 'x86 virtualization is about basically placing another nearly full kernel, full of new bugs, on top of a nasty x86 architecture which barely has correct page protection. Then running your operating system on the other side of this brand new pile of shit. You are absolutely deluded, if not stupid, if you think that a worldwide collection of software engineers who can't writ…

This is just FUD and in the usual insulting De Raadt style of communicating.

'barely has correct page protection' is just a way of saying 'has correct page protection, but I want to be really snotty about it'. So, highlighting a non-problem.

No-one is claiming that virtualization makes a system magically completely secure, but do people actually believe that it makes it less secure? (Compared to, running the same software on the same hardware using a single OS). I don't think so.

Re: XSA-108 Advisory

#15

Post by spacefight » Wed, Oct 01, 2014, 12:54 PM UTC

chippy wrote: post #11

Interesting that the patch is just one characters difference (applied in two locations) 0x3ff to 0xff

Deliberate? Coincidence?

Re: XSA-108 Advisory

#16

Post by fndrplayer13 » Wed, Oct 01, 2014, 12:55 PM UTC

Heh, it's been a rough couple of weeks.

Re: XSA-108 Advisory

#17

Post by lmm » Wed, Oct 01, 2014, 12:57 PM UTC

sudowhodoido wrote: post #10

Well looks like Mr De Raadt was right again: 'x86 virtualization is about basically placing another nearly full kernel, full of new bugs, on top of a nasty x86 architecture which barely has correct page protection. Then running your operating system on the other side of this brand new pile of shit. You are absolutely deluded, if not stupid, if you think that a worldwide collection of software engineers who can't writ…

Why? Virtualization has a much smaller surface area for vulnerabilities than jail-like APIs do.

Re: XSA-108 Advisory

#18

Post by zorpner » Wed, Oct 01, 2014, 12:58 PM UTC

joosters wrote: post #14

sudowhodoido wrote: post #10

Well looks like Mr De Raadt was right again: 'x86 virtualization is about basically placing another nearly full kernel, full of new bugs, on top of a nasty x86 architecture which barely has correct page protection. Then running your operating system on the other side of this brand new pile of shit. You are absolutely deluded, if not stupid, if you think that a worldwide collection of software engineers who can't writ…

This is just FUD and in the usual insulting De Raadt style of communicating. 'barely has correct page protection' is just a way of saying 'has correct page protection, but I want to be really snotty about it'. So, highlighting a non-problem. No-one is claiming that virtualization makes a system magically completely secure, but do people actually believe that it makes it less secure? (Compared to, running the same sof…

(Compared to, running the same software on the same hardware using a single OS). I don't think so.

If you had been running an OpenBSD instance on hardware as a single OS, you would not be vulnerable to having your system's memory read by this hypervisor bug. So... yes.

Re: XSA-108 Advisory

#19

Post by danielweber » Wed, Oct 01, 2014, 1:15 PM UTC

ukandy wrote: post #8

eik3_de wrote: post #6

It will be interesting to see which providers didn't get the embargoed release. So if you get a reboot announcment from your xen vps provider after today 12:00Z, you should list them here.

Pre-disclosure list is at the bottom of this page.. http://www.xenproject.org/security-policy.html

Huh, I have a tiny machine at one of those smaller places, and they are on the list. Good to know the smaller players can build up a reputation for embargoing, too.

Re: XSA-108 Advisory

#20

Post by asb » Wed, Oct 01, 2014, 1:15 PM UTC

Can somebody please confirm that it is impossible to boot a HVM system on Linode? The hypervisor on my Linode host certainly supports HVM (according to cat /sys/hypervisor/properties/capabilities). The host Xen is 4.1 and therefore vulnerable in the case that another user could be running HV guests.