XenServer 6.2 (clearwater) と XenServer 6.5 (Creedence) を中心に雑な感じで書いていきます。といいながら、すでにXenServer8がリリースされている・・・
xe vm-param-list uuid=***************で確認したら、
PV-bootloader ( RW): eliloader
xe vm-param-set uuid=*************** PV-bootloader=pygrubで無事に起動。
ISSUE DESCRIPTION
=================
When unplugging an emulated block device the device was not fully
unplugged, meaning a second unplug attempt would attempt to unplug the
device a second time using a previously freed pointer.
IMPACT
======
An HVM guest which has access to an emulated IDE disk device may be
able to exploit this vulnerability in order to take over the qemu
process elevating its privilege to that of the qemu process.
ISSUE DESCRIPTION
=================
The QEMU model of the RTL8139 network card did not sufficiently
validate inputs in the C+ mode offload emulation. This results in
uninitialised memory from the QEMU process's heap being leaked to the
domain as well as to the network.
IMPACT
======
A guest may be able to read sensitive host-level data relating to
itself which resides in the QEMU process.
Such information may include things such as information relating to
real devices backing emulated devices or passwords which the host
administrator does not intend to share with the guest admin.
This reduces the VM downtime (when both old and new domains are paused) in 0.3s
for each VIF connected to the VM.
CVE-2015-4106 (Medium): Unmediated PCI register access in qemu.
CVE-2015-4163 (Medium): GNTTABOP_swap_grant_ref operation misbehavior.
CVE-2015-4164 (Medium): vulnerability in the iret hypercall handler
CVE-2015-2756 (Low): Unmediated PCI command register access in qemu
CVE-2015-4103 (Low): Potential unintended writes to host MSI message data field via qemu.
CVE-2015-4104 (Low): PCI MSI mask bits inadvertently exposed to guests.
CVE-2015-4105 (Low): Guest triggerable qemu MSI-X pass-through error messages
ISSUE DESCRIPTION
=================
The code in qemu which emulates a floppy disk controller did not
correctly bounds check accesses to an array and therefore was
vulnerable to a buffer overflow attack.
Description of Problem
Citrix is aware of the recent vulnerability that has been reported against the Xen hypervisor. This issue is known as the 'VENOM' vulnerability and has been assigned the following CVE number:
CVE-2015-3456: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3456
The following sections will provide guidance to customers on the potential impact of this issue. Citrix is actively analysing the impact of this vulnerability on supported versions of Citrix XenServer. Additional details and guidance will be added to this document as soon as they are available.
We believe that code execution is possible but we have not yet seen any working reproducers that would allow this.なお、既存のExploitは、QEMUをCrashさせるので、Segfault LOGをみてれば、その攻撃を判定できそうとのこと。
The handler for XEN_DOMCTL_gettscinfo failed to initialize a padding
field subsequently copied to guest memory.
A similar leak existed in XEN_SYSCTL_getdomaininfolist, which is being
addressed here regardless of that operation being declared unsafe for
disaggregation by XSA-77.
Malicious or buggy stub domain kernels or tool stacks otherwise living
outside of Domain0 may be able to read sensitive data relating to the
hypervisor or other guests not under the control of that domain.
ISSUE DESCRIPTION今度はIntel CPUが対象。
=================
Instructions with register operands ignore eventual segment overrides
encoded for them. Due to an insufficiently conditional assignment such
a bogus segment override can, however, corrupt a pointer used
subsequently to store the result of the instruction.
xe patch-upload file-name=XS56ESP2001.xsupdate > XS56SP2-PATCH-UUID
xe patch-upload file-name=XS56ESP2003.xsupdate >> XS56SP2-PATCH-UUID
xe patch-upload file-name=XS56ESP2011.xsupdate >> XS56SP2-PATCH-UUID
xe patch-upload file-name=XS56ESP2023.xsupdate >> XS56SP2-PATCH-UUID
xe patch-upload file-name=XS56ESP2025.xsupdate >> XS56SP2-PATCH-UUID
xe patch-upload file-name=XS56ESP2034.xsupdate >> XS56SP2-PATCH-UUID
for PATCHID in `cat XS56SP2-PATCH-UUID`
do
echo "HOST: ${HOSTUUID} / PATCH: ${PATCHID}"
xe patch-apply host-uuid=${HOSTUUID} uuid=${PATCHID}
done
Try something like (on 6.5 and later)
$ xe vdi-export uuid=… filename=foo.vhd format=vhd ?progress
This article explains changes introduced in XenServer 6.5 to the handling of power settings and describes how users with specific needs can change the configuration.
XenServer's default power settings are optimal for most users, so do not normally need to be modified.
In its default configuration, XenServer 6.5:
* uses all available C-states regardless of BIOS settings,
* uses the "performance" CPU frequency governor for Intel processors and the more power-friendly "ondemand" CPU frequency governor for AMD processors, and
* uses frequency scaling and Turbo mode as controlled by the BIOS settings.
It is recommended to use XenServer's default configuration and to enable OS-controlled frequency scaling and Turbo mode in the BIOS.
XenServer 6.5 do not load soft raid kernel modules on boot. (See comments by Roland Monday on this article).
My solution is:
1. Create file /etc/sysconfig/modules/raid.modules with needed modules
# echo "modprobe raid1" > /etc/sysconfig/modules/raid.modules
you can add lines for another raid level (raid0 or raid10 for example)
2. Make this file executable
# chmod +x /etc/sysconfig/modules/raid.modules
3. Reboot.
PS: I do not know will this changes survive after installing patches
Citrix XenServer: Analysis into the impact of this issue on XenServer is in progress. XenServer does include a vulnerable version of glibc but at present there is no known route by which a guest virtual machine would be able to invoke the vulnerable functionality through the hypervisor interface. Analysis of this is still in progress and this section will be updated when additional information is available.
最後に、この脆弱性が対象とする関数「gethostbyname*()」はすでに古いものとなっています。これらの関数は IPv6アドレスに対応していないため、多くの新しいアプリケーションでは、この脆弱な関数「gethostbyname*()」ではなく、IPv6 をサポートする関数「getaddrinfo()」を使用しているものと考えられます。
以上を考慮すると、「GHOST」を狙った実際の攻撃による危険性は、「Shellshock」や「Heartbleed」などの脆弱性と比較すると低いものになっています。
apache, cups, dovecot, gnupg, isc-dhcp, lighttpd, mariadb/mysql,
nfs-utils, nginx, nodejs, openldap, openssh, postfix, proftpd,
pure-ftpd, rsyslog, samba, sendmail, sysklogd, syslog-ng, tcp_wrappers,
vsftpd, xinetd.
Updated python-virtinst package that fixes several bugs and add various
enhancements are now available for Red Hat Enterprise Linux 6.
VULNERABLE SYSTEMSHVM関連はぽろぽろ出てきますね・・・
==================
Xen versions from 4.2 onwards are vulnerable on x86 systems.
ARM systems are not vulnerable.