=====================================================================

                                 CERT-Renater

                     Note d'Information No. 2022/VULN203

_____________________________________________________________________

DATE                : 16/06/2022

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Xen with Intel x86.

=====================================================================
https://xenbits.xen.org/xsa/advisory-404.html
_____________________________________________________________________

  Xen Security Advisory CVE-2022-21123,CVE-2022-21124,CVE-2022-21166 / 
XSA-404

                  x86: MMIO Stale Data vulnerabilities

ISSUE DESCRIPTION
=================

This issue is related to the SRBDS, TAA and MDS vulnerabilities.
Please see:

   https://xenbits.xen.org/xsa/advisory-320.html (SRBDS)
   https://xenbits.xen.org/xsa/advisory-305.html (TAA)
   https://xenbits.xen.org/xsa/advisory-297.html (MDS)

Please see Intel's whitepaper:

 
https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/technical-documentation/processor-mmio-stale-data-vulnerabilities.html

IMPACT
======

An attacker might be able to directly read or infer data from
other security contexts in the system.  This can include data
belonging to other VMs, or to Xen itself.  The degree to which
an attacker can obtain data depends on the CPU, and the system
configuration.

VULNERABLE SYSTEMS
==================

Systems running all versions of Xen are affected.

Only x86 processors are vulnerable.  Processors from other
manufacturers (e.g. ARM) are not believed to be vulnerable.

Only Intel based processors are affected.  Processors from
other x86 manufacturers (e.g. AMD) are not believed to be
vulnerable.

Please consult the Intel Security Advisory for details on
the affected processors and configurations.

Per Xen's support statement, PCI passthrough should be to
trusted domains because the overall system security depends
on factors outside of Xen's control.

As such, Xen, in a supported configuration, is not vulnerable
to DRPW/SBDR.

MITIGATION
==========

All mitigations depend on functionality added in the IPU 2022.1
(May 2022) microcode release from Intel.  Consult your dom0 OS
vendor.

To the best of the security team's understanding, the summary is
as follows:

Server CPUs (Xeon EP/EX, Scalable, and some Atom servers),
excluding Xeon E3 (which use the client CPU design), are
potentially vulnerable to DRPW (CVE-2022-21166).

Client CPUs (inc Xeon E3) are, furthermore, potentially
vulnerable to SBDR (CVE-2022-21123) and SBDS (CVE-2022-21125).

SBDS only affects CPUs vulnerable to MDS.  On these CPUs,
there are previously undiscovered leakage channels.  There is no
change to the existing MDS mitigations.

DRPW and SBDR only affects configurations where less privileged
domains have MMIO mappings of buggy endpoints.  Consult your
hardware vendor.

In configurations where less privileged domains have MMIO access
to buggy endpoints, `spec-ctrl=unpriv-mmio` can be enabled which
will cause Xen to mitigate cross-domain fill buffer leakage, and
extend SRBDS protections to protect RNG data from leakage.

RESOLUTION
==========

Applying the appropriate attached patch resolves this issue.

Note that patches for released versions are generally prepared
to apply to the stable branches, and may not apply cleanly to the
most recent release tarball.  Downstreams are encouraged to update
to the tip of the stable branch before applying these patches.

The patches are still under review.  An update will be sent once
they are reviewed and the backports are done.

xsa404/xsa404-?.patch           xen-unstable

$ sha256sum xsa404*/*
18b307c2cbbd08d568e9dcb2447901d94e22ff1e3945c3436173aa693f6456fb 
xsa404/xsa404-1.patch
d6f193ad963396285e983aa1c18539f67222582711fc62105c21b71b3b53a97d 
xsa404/xsa404-2.patch
d2c123ccdf5eb9f862d6e9cb0e59045ae18799a07db149c7d90e301ca20436aa 
xsa404/xsa404-3.patch
$

NOTE CONCERNING CVE-2022-21127 / Update to SRBDS
================================================

An issue was discovered with the SRBDS microcode mitigation.  A
microcode update was released as part of Intel's IPU 2022.1 in
May 2022.

Updating microcode is sufficient to fix the issue, with no extra
actions required on Xen's behalf.  Consult your dom0 OS vendor or
OEM for updated microcode.


NOTE CONCERNING CVE-2022-21180 / Undefined MMIO Hang
====================================================

A related issue was discovered.  See:

 
https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/advisory-guidance/undefined-mmio-hang.html

Xen is not vulnerable to UMH in supported configurations.

The only mitigation to is avoid passing impacted devices through
to untrusted guests.


=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================