====================================================================

                                CERT-Renater

                    Note d'Information No. 2024/VULN380
_____________________________________________________________________

DATE                : 24/09/2024

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Xen.

=====================================================================
https://xenbits.xen.org/xsa/advisory-462.html
_____________________________________________________________________


             Xen Security Advisory CVE-2024-45817 / XSA-462
                                version 2

                     x86: Deadlock in vlapic_error()

UPDATES IN VERSION 2
====================

Public release.

ISSUE DESCRIPTION
=================

In x86's APIC (Advanced Programmable Interrupt Controller) architecture,
error conditions are reported in a status register.  Furthermore,
the OS can opt to receive an interrupt when a new error occurs.

It is possible to configure the error interrupt with an illegal
vector, which generates an error when an error interrupt is raised.

This case causes Xen to recurse through vlapic_error().  The recursion
itself is bounded; errors accumulate in the the status register and
only generate an interrupt when a new status bit becomes set.

However, the lock protecting this state in Xen will try to be taken
recursively, and deadlock.

IMPACT
======

A buggy or malicious HVM or PVH guest can deadlock Xen, leading to a
DoS.

VULNERABLE SYSTEMS
==================

Xen 4.5 and onwards are vulnerable.  Xen 4.4 and older are not
vulnerable.

Only x86 systems running HVM or PVH guests are vulnerable.
Architectures other than x86 are not vulnerable.

Only HVM or PVH guests can leverage the vulnerability.  PV guests
cannot leverage the vulnerability.

MITIGATION
==========

Not running untrusted HVM or PVH VMs will avoid this vulnerability.

CREDITS
=======

This issue was discovered after a BUGSENG team working on MISRA C
compliance of Xen pointed attention to ECLAIR reports for MISRA C
Rule 17.2 (Functions shall not call themselves, either directly
or indirectly).

RESOLUTION
==========

Applying the attached patch resolves this issue.

Note that patches for released versions are generally prepared to
apply to the stable branches, and may not apply cleanly to the
most recent release tarball.  Downstreams are encouraged to update
to the tip of the stable branch before applying these patches.

xsa462.patch           xen-unstable - Xen 4.16.x

$ sha256sum xsa462*
c8cb03fdcfffa7e043b1d82643efde0f93bff5ce484887c6f59207777ee95be7 
xsa462.patch
$

DEPLOYMENT DURING EMBARGO
=========================

Deployment of the patches and/or mitigations described above (or
others which are substantially similar) is permitted during the
embargo, even on public-facing systems with untrusted guest users
and administrators.

But: Distribution of updated software is prohibited (except to other
members of the predisclosure list).

Predisclosure list members who wish to deploy significantly different
patches and/or mitigations, please contact the Xen Project Security
Team.


(Note: this during-embargo deployment notice is retained in
post-embargo publicly released Xen Project advisories, even though
it is then no longer applicable.  This is to enable the community
to have oversight of the Xen Project Security Team's decisionmaking.)

For more information about permissible uses of embargoed information,
consult the Xen Project community's agreed Security Policy:
   http://www.xenproject.org/security-policy.html

=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================