[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]
NetBSD Security Advisory 2018-005: Privilege separation bug in Xen-amd64
-----BEGIN PGP SIGNED MESSAGE-----
NetBSD Security Advisory 2018-005
Topic: Privilege separation bug in Xen-amd64
Version: NetBSD-current: source prior to Sun, Dec 31st 2017
NetBSD 7.1.2: not affected
NetBSD 7.1 - 7.1.1: affected
NetBSD 7.0 - 7.0.2: affected
NetBSD 6.1 - 6.1.5: affected
NetBSD 6.0 - 6.0.6: affected
Severity: Privilege escalation / Local DoS
Fixed: NetBSD-current: Sun, Dec 31st 2017
NetBSD-7-1 branch: Mon, Jan 22nd 2018
NetBSD-7-0 branch: Mon, Jan 22nd 2018
NetBSD-7 branch: Mon, Jan 22nd 2018
NetBSD-6-1 branch: Mon, Feb 19th 2018
NetBSD-6-0 branch: Mon, Feb 19th 2018
NetBSD-6 branch: Mon, Feb 19th 2018
Teeny versions released later than the fix date will contain the fix.
Please note that NetBSD releases prior to 6.0 are no longer supported.
It is recommended that all users upgrade to a supported release.
A mistake the Xen-amd64 port of NetBSD allowed unprivileged users to
read from and write to the CPU's I/O ports. This could be used to
The kernel uses several flags that define CPU protections, and in particular,
SEL_KPL and SEL_UPL, that respectively define "kernel" privileges and "user"
privileges in the %cs register.
64bit Xen PV guests run, by design, in ring3, the same protection level as
userland. As a result, SEL_KPL equals SEL_UPL.
Xen uses a specific iopl privilege mechanism to control access rights to
the CPU I/O ports: it expects the iopl value to match the intended privilege,
and not the hardware privilege. Therefore, if the kernel wanted to prevent
userland from accessing the CPU I/O ports, it had to set the iopl to ring0,
even if the kernel actually runs in ring3.
A mistake existed in NetBSD, where iopl was unintentionally set to ring3,
allowing userland to access CPU I/O ports. The mistake in question was a
confusion with the privilege flags: iopl was set to SEL_KPL, but in the case
of Xen-amd64 this was equal to SEL_UPL, which meant ring3.
Solutions and Workarounds
For all NetBSD versions, you need to obtain fixed kernel sources,
rebuild and install the new kernel, and reboot the system.
The fixed source may be obtained from the NetBSD CVS repository.
The following instructions briefly summarize how to upgrade your
kernel. In these instructions, replace:
ARCH with your architecture (from uname -m),
KERNCONF with the name of your kernel configuration file and
VERSION with the file version below
File versions containing the fixes:
FILE HEAD netbsd-7 netbsd-7-0 netbsd-7-1
---- ---- -------- ---------- ----------
1.280 184.108.40.206 220.127.116.11 18.104.22.168
1.34 22.214.171.124 126.96.36.199 188.8.131.52
1.800 1.752.4.2 1.752.8.2 1.752.12.2
1.64 184.108.40.206 220.127.116.11 18.104.22.168
1.30 22.214.171.124 126.96.36.199 188.8.131.52.2.1
FILE netbsd-6 netbsd-6-0 netbsd-6-1
---- -------- ---------- ----------
184.108.40.206 220.127.116.11.2.3 18.104.22.168.2.2
22.214.171.124 126.96.36.199 188.8.131.52
1.717.2.9 1.7184.108.40.206.2 1.7220.127.116.11.2
18.104.22.168 22.214.171.124 126.96.36.199
188.8.131.52 184.108.40.206 220.127.116.11
To update from CVS, re-build, and re-install the kernel:
# cd src
# cvs update -d -P -r VERSION sys/arch/amd64/amd64/machdep.c
# cvs update -d -P -r VERSION sys/arch/amd64/include/segments.h
# cvs update -d -P -r VERSION sys/arch/i386/i386/machdep.c
# cvs update -d -P -r VERSION sys/arch/i386/include/segments.h
# cvs update -d -P -r VERSION sys/arch/x86/x86/vm_machdep.c
# ./build.sh kernel=KERNCONF
# mv /netbsd /netbsd.old
# cp sys/arch/ARCH/compile/obj/KERNCONF/netbsd /netbsd
# shutdown -r now
For more information on how to do this, see:
Maxime Villard for finding and fixing the issue.
2018-04-09 Initial release
Advisories may be updated as new information becomes available.
The most recent version of this advisory (PGP signed) can be found at
Information about NetBSD and NetBSD security can be found at
http://www.NetBSD.org/ and http://www.NetBSD.org/Security/ .
Copyright 2018, The NetBSD Foundation, Inc. All Rights Reserved.
Redistribution permitted only in full, unmodified form.
-----BEGIN PGP SIGNATURE-----
-----END PGP SIGNATURE-----
Main Index |
Thread Index |