oss-sec mailing list archives

Re: Xen Security Advisory 9 (CVE-2012-2934) - PV guest host DoS (AMD erratum #121)

From: Florian Weimer <fw () deneb enyo de>
Date: Thu, 14 Jun 2012 20:20:07 +0200

* Xen org security team:

There is no software fix for this issue. The workaround suggested by
AMD in erratum #121 cannot be applied to Xen since the relevant address
is under guest control.

Applying the patch will cause Xen to detect vulnerable systems and
refuse to boot.


This response puzzles me.  Isn't this changing a potential denial of
service (a para-virtualized guest could attempt an exploit) to a
definite one (the system won't boot)?  Why is this a good idea?

Current thread:

Xen Security Advisory 9 (CVE-2012-2934) - PV guest host DoS (AMD erratum #121) Xen . org security team (Jun 12)
- Re: Xen Security Advisory 9 (CVE-2012-2934) - PV guest host DoS (AMD erratum #121) Florian Weimer (Jun 14)
  - Re: Xen Security Advisory 9 (CVE-2012-2934) - PV guest host DoS (AMD erratum #121) Giles Coochey (Jun 15)
    - Re: Xen Security Advisory 9 (CVE-2012-2934) - PV guest host DoS (AMD erratum #121) Florian Weimer (Jun 15)
    - Re: Xen Security Advisory 9 (CVE-2012-2934) - PV guest host DoS (AMD erratum #121) John Haxby (Jun 15)
    - Re: Xen Security Advisory 9 (CVE-2012-2934) - PV guest host DoS (AMD erratum #121) Marcus Meissner (Jun 20)
    - Re: Xen Security Advisory 9 (CVE-2012-2934) - PV guest host DoS (AMD erratum #121) Florian Weimer (Jun 24)