Xen XSA-183: Missing SMAP Whitelisting in 32-bit PV Exception Delivery

Key Information Vulnerability Overview Advisory: XSA-183 Public Release: 2016-07-26 11:33 Updated: 2023-12-15 15:35 Version: 6 CVE: CVE-2016-6259 Title: x86: Missing SMAP whitelisting in 32-bit exception / event delivery Vulnerability Description Issue Description: SMAP (Supervisor Mode Access Prevention) is a hardware feature designed to trigger page faults in the operating system, preventing accidental pointer chasing into user space, thereby enhancing system robustness. Legitimate access to user space requires a whitelisting mechanism, but the exception delivery mechanism for 32-bit PV guests was not whitelisted. Impact: A malicious 32-bit PV guest kernel can trigger security checks, causing a crash, which may result in disruption of other virtual machine services running on the host. Vulnerable Systems: Xen versions 4.5 and higher are affected. This vulnerability is only exposed on x86 hardware supporting SMAP (Intel Broadwell and later CPUs), and does not affect ARM hardware or x86 hardware without SMAP support. Only 32-bit PV guests are vulnerable to this issue. Mitigation Mitigation: Running only HVM guests or 64-bit PV guests avoids this vulnerability. Disabling SMAP by adding at Xen boot time can also mitigate the issue, but may increase the risk of other unknown vulnerabilities. Resolution Resolution: Apply the appropriate patch to resolve the issue. The corresponding Xen versions and patch files are as follows: - xen-unstable: xsa183-unstable.patch - xen-4.7.x: xsa183-4.7.patch - xen-4.6.x, 4.5.x: xsa183-4.6.patch Credits Credits: This issue was discovered by Andrew Cooper from Citrix.

Goal Reached Thanks to every supporter — we hit 100%!

Xen XSA-183: Missing SMAP Whitelisting in 32-bit PV Exception Delivery