=====================================================================

                                      CERT-Renater

                           Note d'Information No. 2024/VULN056
_____________________________________________________________________

DATE                : 25/01/2024

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Xen.

=====================================================================
https://xenbits.xen.org/xsa/advisory-448.html
_____________________________________________________________________

             Xen Security Advisory CVE-2023-46838 / XSA-448
                                version 2

       Linux: netback processing of zero-length transmit fragment

UPDATES IN VERSION 2
====================

Public release.

ISSUE DESCRIPTION
=================

Transmit requests in Xen's virtual network protocol can consist
of multiple parts.  While not really useful, except for the initial
part any of them may be of zero length, i.e. carry no data at all.
Besides a certain initial portion of the to be transferred data,
these parts are directly translated into what Linux calls SKB
fragments. Such converted request parts can, when for a particular
SKB they are all of length zero, lead to a de-reference of NULL in
core networking code.

IMPACT
======

An unprivileged guest can cause Denial of Service (DoS) of the host
by sending network packets to the backend, causing the backend to
crash.

Data corruption or privilege escalation have not been ruled out.

VULNERABLE SYSTEMS
==================

All systems using a Linux based network backend with kernel 4.14 and
newer are vulnerable.  Earlier versions may also be vulnerable.
Systems using other network backends are not known to be vulnerable.

MITIGATION
==========

Using a userspace PV network backend (e.g. the qemu based "qnic"
backend) will mitigate the problem.

Using a dedicated network driver domain per guest will mitigate
the problem.

CREDITS
=======

This issue was discovered by Pratyush Yadav of Amazon.

RESOLUTION
==========

Applying the attached patch resolves this issue.

xsa448-linux.patch           Linux 6.7-rc - 6.5

$ sha256sum xsa448*
f8c87cf546c2bc70970ca151c0ec8c1940f969e29c4cb3d2ec37ff9e43ddfc36 
xsa448-linux.patch
$

NOTE CONCERNING EARLY DISCLOSURE
================================

The embargo was intended to be 2024-01-23 12:00 UTC, but a
downstream had a mixup of days and published early.

DEPLOYMENT DURING EMBARGO
=========================

Deployment of the patches and/or mitigations described above (or
others which are substantially similar) is permitted during the
embargo, even on public-facing systems with untrusted guest users and
administrators.

But: Distribution of updated software is prohibited (except to other
members of the predisclosure list).

Predisclosure list members who wish to deploy significantly different
patches and/or mitigations, please contact the Xen Project Security
Team.

(Note: this during-embargo deployment notice is retained in
post-embargo publicly released Xen Project advisories, even though
it is then no longer applicable.  This is to enable the community to
have oversight of the Xen Project Security Team's decisionmaking.)

For more information about permissible uses of embargoed
information, consult the Xen Project community's agreed Security
Policy:
   http://www.xenproject.org/security-policy.html


=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================