linux-kernel - Re: CVE-2025-38046: xen: Add support for XenServer 6.1 platform device

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <42f8eb9a-2807-4a7f-9e24-35e87a35c6f3@suse.com>
Date: Wed, 18 Jun 2025 11:55:24 +0200
From: Juergen Gross <jgross@...e.com>
To: cve@...nel.org, linux-kernel@...r.kernel.org
Subject: Re: CVE-2025-38046: xen: Add support for XenServer 6.1 platform
 device

On 18.06.25 11:33, Greg Kroah-Hartman wrote:
> From: Greg Kroah-Hartman <gregkh@...nel.org>
> 
> Description
> ===========
> 
> In the Linux kernel, the following vulnerability has been resolved:
> 
> xen: Add support for XenServer 6.1 platform device
> 
> On XenServer on Windows machine a platform device with ID 2 instead of
> 1 is used.
> 
> This device is mainly identical to device 1 but due to some Windows
> update behaviour it was decided to use a device with a different ID.
> 
> This causes compatibility issues with Linux which expects, if Xen
> is detected, to find a Xen platform device (5853:0001) otherwise code
> will crash due to some missing initialization (specifically grant
> tables). Specifically from dmesg
> 
>      RIP: 0010:gnttab_expand+0x29/0x210
>      Code: 90 0f 1f 44 00 00 55 31 d2 48 89 e5 41 57 41 56 41 55 41 89 fd
>            41 54 53 48 83 ec 10 48 8b 05 7e 9a 49 02 44 8b 35 a7 9a 49 02
>            <8b> 48 04 8d 44 39 ff f7 f1 45 8d 24 06 89 c3 e8 43 fe ff ff
>            44 39
>      RSP: 0000:ffffba34c01fbc88 EFLAGS: 00010086
>      ...
> 
> The device 2 is presented by Xapi adding device specification to
> Qemu command line.
> 
> The Linux kernel CVE team has assigned CVE-2025-38046 to this issue.

Please revoke this CVE, as this issue can't be triggered by an
unprivileged user.


Juergen

Download attachment "OpenPGP_0xB0DE9DD628BF132F.asc" of type "application/pgp-keys" (3684 bytes)

Download attachment "OpenPGP_signature.asc" of type "application/pgp-signature" (496 bytes)