oss-sec mailing list archives
Re: Xen Security Advisory 9 (CVE-2012-2934) - PV guest host DoS (AMD erratum #121)
From: Giles Coochey <giles () coochey net>
Date: Fri, 15 Jun 2012 15:23:35 +0100
On 14/06/2012 19:20, Florian Weimer wrote:
* Xen org security team:There is no software fix for this issue. The workaround suggested by AMD in erratum #121 cannot be applied to Xen since the relevant address is under guest control. Applying the patch will cause Xen to detect vulnerable systems and refuse to boot.This response puzzles me. Isn't this changing a potential denial of service (a para-virtualized guest could attempt an exploit) to a definite one (the system won't boot)? Why is this a good idea?
It ensures that the user of the system is aware of the risks.This position will only occur when the patch to the vulnerability is applied (i.e. during an out of service upgrade). The admins of the system should always read the release notes to patches and upgrades - otherwise they wouldn't know what else might be broken, deprecated.
I think it's the right approach. -- Regards, Giles Coochey, CCNA, CCNAS NetSecSpec Ltd +44 (0) 7983 877438 http://www.coochey.net http://www.netsecspec.co.uk giles () coochey net
Attachment:
smime.p7s
Description: S/MIME Cryptographic Signature
Current thread:
- Xen Security Advisory 9 (CVE-2012-2934) - PV guest host DoS (AMD erratum #121) Xen . org security team (Jun 12)
- Re: Xen Security Advisory 9 (CVE-2012-2934) - PV guest host DoS (AMD erratum #121) Florian Weimer (Jun 14)
- Re: Xen Security Advisory 9 (CVE-2012-2934) - PV guest host DoS (AMD erratum #121) Giles Coochey (Jun 15)
- Re: Xen Security Advisory 9 (CVE-2012-2934) - PV guest host DoS (AMD erratum #121) Florian Weimer (Jun 15)
- Re: Xen Security Advisory 9 (CVE-2012-2934) - PV guest host DoS (AMD erratum #121) John Haxby (Jun 15)
- Re: Xen Security Advisory 9 (CVE-2012-2934) - PV guest host DoS (AMD erratum #121) Marcus Meissner (Jun 20)
- Re: Xen Security Advisory 9 (CVE-2012-2934) - PV guest host DoS (AMD erratum #121) Florian Weimer (Jun 24)
- Re: Xen Security Advisory 9 (CVE-2012-2934) - PV guest host DoS (AMD erratum #121) Giles Coochey (Jun 15)
- Re: Xen Security Advisory 9 (CVE-2012-2934) - PV guest host DoS (AMD erratum #121) Florian Weimer (Jun 14)