linux-kernel - Re: CVE-2025-38046: xen: Add support for XenServer 6.1 platform device

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <2025061823-powdery-gauze-b705@gregkh>
Date: Wed, 18 Jun 2025 13:21:31 +0200
From: Greg KH <greg@...ah.com>
To: Juergen Gross <jgross@...e.com>
Cc: cve@...nel.org, linux-kernel@...r.kernel.org
Subject: Re: CVE-2025-38046: xen: Add support for XenServer 6.1 platform
 device

On Wed, Jun 18, 2025 at 11:55:24AM +0200, Juergen Gross wrote:
> On 18.06.25 11:33, Greg Kroah-Hartman wrote:
> > From: Greg Kroah-Hartman <gregkh@...nel.org>
> > 
> > Description
> > ===========
> > 
> > In the Linux kernel, the following vulnerability has been resolved:
> > 
> > xen: Add support for XenServer 6.1 platform device
> > 
> > On XenServer on Windows machine a platform device with ID 2 instead of
> > 1 is used.
> > 
> > This device is mainly identical to device 1 but due to some Windows
> > update behaviour it was decided to use a device with a different ID.
> > 
> > This causes compatibility issues with Linux which expects, if Xen
> > is detected, to find a Xen platform device (5853:0001) otherwise code
> > will crash due to some missing initialization (specifically grant
> > tables). Specifically from dmesg
> > 
> >      RIP: 0010:gnttab_expand+0x29/0x210
> >      Code: 90 0f 1f 44 00 00 55 31 d2 48 89 e5 41 57 41 56 41 55 41 89 fd
> >            41 54 53 48 83 ec 10 48 8b 05 7e 9a 49 02 44 8b 35 a7 9a 49 02
> >            <8b> 48 04 8d 44 39 ff f7 f1 45 8d 24 06 89 c3 e8 43 fe ff ff
> >            44 39
> >      RSP: 0000:ffffba34c01fbc88 EFLAGS: 00010086
> >      ...
> > 
> > The device 2 is presented by Xapi adding device specification to
> > Qemu command line.
> > 
> > The Linux kernel CVE team has assigned CVE-2025-38046 to this issue.
> 
> Please revoke this CVE, as this issue can't be triggered by an
> unprivileged user.

Now rejected, thanks for the review.

greg k-h