| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <2024061914-CVE-2021-47575-a011@gregkh> Date: Wed, 19 Jun 2024 16:54:14 +0200 From: Greg Kroah-Hartman <gregkh@...uxfoundation.org> To: linux-cve-announce@...r.kernel.org Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org> Subject: CVE-2021-47575: xen/console: harden hvc_xen against event channel storms Description =========== In the Linux kernel, the following vulnerability has been resolved: xen/console: harden hvc_xen against event channel storms The Xen console driver is still vulnerable for an attack via excessive number of events sent by the backend. Fix that by using a lateeoi event channel. For the normal domU initial console this requires the introduction of bind_evtchn_to_irq_lateeoi() as there is no xenbus device available at the time the event channel is bound to the irq. As the decision whether an interrupt was spurious or not requires to test for bytes having been read from the backend, move sending the event into the if statement, as sending an event without having found any bytes to be read is making no sense at all. This is part of XSA-391 --- V2: - slightly adapt spurious irq detection (Jan Beulich) V3: - fix spurious irq detection (Jan Beulich) The Linux kernel CVE team has assigned CVE-2021-47575 to this issue. Affected and fixed versions =========================== Fixed in 4.4.296 with commit c7eaa5082bcc Fixed in 4.9.294 with commit 728389c21176 Fixed in 4.14.259 with commit 68b78f976ca4 Fixed in 4.19.222 with commit 57e46acb3b48 Fixed in 5.4.168 with commit 560e64413b4a Fixed in 5.10.88 with commit 8fa3a370cc2a Fixed in 5.15.11 with commit 153d1ea32722 Fixed in 5.16 with commit fe415186b43d Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2021-47575 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/tty/hvc/hvc_xen.c drivers/xen/events/events_base.c include/xen/events.h Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/c7eaa5082bccfc00dfdb500ac6cc86d6f24ca027 https://git.kernel.org/stable/c/728389c21176b2095fa58e858d5ef1d2f2aac429 https://git.kernel.org/stable/c/68b78f976ca47d52c03c41eded207a312e46b934 https://git.kernel.org/stable/c/57e46acb3b48ea4e8efb1e1bea2e89e0c6cc43e2 https://git.kernel.org/stable/c/560e64413b4a6d9bd6630e350d5f2e6a05f6ffe3 https://git.kernel.org/stable/c/8fa3a370cc2af858a9ba662ca4f2bd0917550563 https://git.kernel.org/stable/c/153d1ea3272209fc970116f09051002d14422cde https://git.kernel.org/stable/c/fe415186b43df0db1f17fa3a46275fd92107fe71
Powered by blists - more mailing lists