Bastian Blank
2012-Aug-08 13:48 UTC
[Pkg-xen-changes] r1086 - in branches/wheezy/xen/debian: . patches
Author: waldi
Date: Wed Aug 8 13:48:50 2012
New Revision: 1086
Log:
* debian/changelog: Update.
* debian/patches: Add new patches. Add fix for CVE-2012-3433.
Added:
branches/wheezy/xen/debian/patches/CVE-2012-3433
branches/wheezy/xen/debian/patches/upstream-23327:9d30201cbcc4
Modified:
branches/wheezy/xen/debian/changelog
branches/wheezy/xen/debian/patches/series
Modified: branches/wheezy/xen/debian/changelog
=============================================================================---
branches/wheezy/xen/debian/changelog Mon Aug 6 15:39:30 2012 (r1085)
+++ branches/wheezy/xen/debian/changelog Wed Aug 8 13:48:50 2012 (r1086)
@@ -7,6 +7,9 @@
- Fix IOMMU support for PCI-to-PCIe bridges.
- Disallow access to some sensitive IO-ports.
* Fixup broken patches.
+ * Revert one broken change.
+ * Don''t leave the x86 emulation in a bad state. (closes: #683279)
+ CVE-2012-3433
-- Bastian Blank <waldi at debian.org> Mon, 30 Jul 2012 21:06:34 +0200
Added: branches/wheezy/xen/debian/patches/CVE-2012-3433
=============================================================================---
/dev/null 00:00:00 1970 (empty, because file is newly added)
+++ branches/wheezy/xen/debian/patches/CVE-2012-3433 Wed Aug 8 13:48:50 2012
(r1086)
@@ -0,0 +1,39 @@
+# HG changeset patch
+# User Jan Beulich <jbeulich at suse.com>
+# Date 1343318195 -3600
+# Node ID a43f5b4b03319117edba76ebca8f827119d4e9a8
+# Parent e89be0dedeb4e4a9556cf3e1b9a5295ba0b59edf
+x86/hvm: don''t leave emulator in inconsistent state
+
+The fact that handle_mmio(), and thus the instruction emulator, is
+being run through twice for emulations that require involvement of the
+device model, allows for the second run to see a different guest state
+than the first one. Since only the MMIO-specific emulation routines
+update the vCPU''s io_state, if they get invoked on the second pass,
+internal state (and particularly this variable) can be left in a state
+making successful emulation of a subsequent MMIO operation impossible.
+
+Consequently, whenever the emulator invocation returns without
+requesting a retry of the guest instruction, reset io_state.
+
+[ This is a security issue. XSA#10. -iwj ]
+
+Signed-off-by: Jan Beulich <jbeulich at suse.com>
+Acked-by: Keir Fraser <keir at xen.org>
+Committed-by: Ian Jackson <ian.jackson at eu.citrix.com>
+
+xen-unstable changeset: 25682:ffcb24876b4f
+Committed-by: Ian Jackson <ian.jackson at eu.citrix.com>
+
+diff -r e89be0dedeb4 -r a43f5b4b0331 xen/arch/x86/hvm/io.c
+--- a/xen/arch/x86/hvm/io.c Sun Jul 22 16:39:00 2012 +0100
++++ b/xen/arch/x86/hvm/io.c Thu Jul 26 16:56:35 2012 +0100
+@@ -176,6 +176,8 @@
+
+ rc = hvm_emulate_one(&ctxt);
+
++ if ( rc != X86EMUL_RETRY )
++ curr->arch.hvm_vcpu.io_state = HVMIO_none;
+ if ( curr->arch.hvm_vcpu.io_state == HVMIO_awaiting_completion )
+ curr->arch.hvm_vcpu.io_state =
HVMIO_handle_mmio_awaiting_completion;
+ else
Modified: branches/wheezy/xen/debian/patches/series
=============================================================================---
branches/wheezy/xen/debian/patches/series Mon Aug 6 15:39:30 2012 (r1085)
+++ branches/wheezy/xen/debian/patches/series Wed Aug 8 13:48:50 2012 (r1086)
@@ -4,6 +4,8 @@
upstream-23939:51288f69523f-rework
upstream-23940:187d59e32a58
upstream-25290:7a6dcecb1781-rework
+CVE-2012-3433
+upstream-23327:9d30201cbcc4
xen-x86-interrupt-pointer-missmatch.diff
Added: branches/wheezy/xen/debian/patches/upstream-23327:9d30201cbcc4
=============================================================================---
/dev/null 00:00:00 1970 (empty, because file is newly added)
+++ branches/wheezy/xen/debian/patches/upstream-23327:9d30201cbcc4 Wed Aug 8
13:48:50 2012 (r1086)
@@ -0,0 +1,18 @@
+# HG changeset patch
+# User Keir Fraser <keir at xen.org>
+# Date 1343651864 -3600
+# Node ID 9d30201cbcc4f50fec6ee7302785ee0f916423f8
+# Parent c23c84dbd98990dd67f1f3d593a91750e753372e
+Revert xen-unstable:25487:baa85434d0ec. Not applicable to 4.1 branch.
+
+diff -r c23c84dbd989 -r 9d30201cbcc4 xen/arch/x86/mm.c
+--- a/xen/arch/x86/mm.c Mon Jul 30 13:34:45 2012 +0100
++++ b/xen/arch/x86/mm.c Mon Jul 30 13:37:44 2012 +0100
+@@ -1801,7 +1801,6 @@
+ return 0;
+ case -1:
+ l1e_remove_flags(nl1e, _PAGE_RW);
+- rc = 0;
+ break;
+ }
+