Synopsis

Moderate: xen security and bug fix update

Type/Severity

Security Advisory: Moderate

Topic

Updated xen packages that resolve several security issues and a bug are now
available for Red Hat Enterprise Linux 5.

This update has been rated as having moderate security impact by the Red
Hat Security Response Team.

Description

The xen packages contain the Xen tools and management daemons needed to
manage virtual machines running on Red Hat Enterprise Linux.

Xen was found to allow unprivileged DomU domains to overwrite xenstore
values which should only be changeable by the privileged Dom0 domain. An
attacker controlling a DomU domain could, potentially, use this flaw to
kill arbitrary processes in Dom0 or trick a Dom0 user into accessing the
text console of a different domain running on the same host. This update
makes certain parts of the xenstore tree read-only to the unprivileged DomU
domains. (CVE-2008-4405)

It was discovered that the qemu-dm.debug script created a temporary file in
/tmp in an insecure way. A local attacker in Dom0 could, potentially, use
this flaw to overwrite arbitrary files via a symlink attack. Note: This
script is not needed in production deployments and therefore was removed
and is not shipped with updated xen packages. (CVE-2008-4993)

This update also fixes the following bug:

• xen calculates its running time by adding the hypervisor's up-time to the
  hypervisor's boot-time record. In live migrations of para-virtualized
  guests, however, the guest would over-write the new hypervisor's boot-time
  record with the boot-time of the previous hypervisor. This caused
  time-dependent processes on the guests to fail (for example, crond would
  fail to start cron jobs). With this update, the new hypervisor's boot-time
  record is no longer over-written during live migrations.
  

All xen users are advised to upgrade to these updated packages, which
contain backported patches to resolve these issues. The Xen host must be
restarted for the update to take effect.

Solution

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

Affected Products

• Red Hat Enterprise Linux Server 5 x86_64
• Red Hat Enterprise Linux Server 5 ia64
• Red Hat Enterprise Linux Server 5 i386
• Red Hat Enterprise Linux Server - Extended Update Support 5.2 x86_64
• Red Hat Enterprise Linux Server - Extended Update Support 5.2 ia64
• Red Hat Enterprise Linux Server - Extended Update Support 5.2 i386
• Red Hat Enterprise Linux Workstation 5 x86_64
• Red Hat Enterprise Linux Workstation 5 i386
• Red Hat Enterprise Linux Desktop 5 x86_64
• Red Hat Enterprise Linux Desktop 5 i386
• Red Hat Enterprise Linux Server from RHUI 5 x86_64
• Red Hat Enterprise Linux Server from RHUI 5 i386

Fixes

• BZ - 464455 - timer stops running after live migrate or dom0 reboot & save/restore of a Xen guest
• BZ - 464817 - CVE-2008-4405 xen: Multiple unsafe uses of guest-writable data from xenstore
• BZ - 470795 - CVE-2008-4993 xen: insecure temporary file use in qemu-dm.debug

CVEs

• CVE-2008-4405
• CVE-2008-4993

References

• http://www.redhat.com/security/updates/classification/#moderate

Red Hat Enterprise Linux Server 5

SRPM
xen-3.0.3-64.el5_2.9.src.rpm	SHA-256: 3cfa1cb443c2beedd8175e7454160fbc580b10cf102ec9021515be6b735ee6e9
x86_64
xen-3.0.3-64.el5_2.9.x86_64.rpm	SHA-256: b88338ff1da7e31c72453a71fc90fdebf7119fd1a58a26019b7d588db9f0ff1b
xen-devel-3.0.3-64.el5_2.9.i386.rpm	SHA-256: da90eec00ddc129e17bb057580a717d02844661997ec8ad544fd24302bf52bc3
xen-devel-3.0.3-64.el5_2.9.x86_64.rpm	SHA-256: 636e4cfd4bc3109a7f733f71b1ab9290f43f4153986761df193de9077076eb05
xen-libs-3.0.3-64.el5_2.9.i386.rpm	SHA-256: 6e4a540c905cb977aaf97f29a3ab0e8dad17cc9e4ad2cb22f78b4baa10343cdc
xen-libs-3.0.3-64.el5_2.9.x86_64.rpm	SHA-256: 3ebd49a0e3cc4fac528bf1284016f0875d34850787e92a117c0c36ddf4288771
ia64
xen-3.0.3-64.el5_2.9.ia64.rpm	SHA-256: c59571a2366cf37e7cec6da6d33142ca6b2b0f869dddea4915d50976e1411bf0
xen-devel-3.0.3-64.el5_2.9.ia64.rpm	SHA-256: 1a91013fb280868e665de2f0f7622df44de5e027f74e0996d96a91d5f6d8da37
xen-libs-3.0.3-64.el5_2.9.ia64.rpm	SHA-256: 3dc1c5dc6326667dfbde9d0903f955bbd88fb3ebe08b6309755a279fb538ce3b
i386
xen-3.0.3-64.el5_2.9.i386.rpm	SHA-256: e043f6190c6dfa0d35fd104c81f0900747651252e359e7609a5c6df6f29ae423
xen-devel-3.0.3-64.el5_2.9.i386.rpm	SHA-256: da90eec00ddc129e17bb057580a717d02844661997ec8ad544fd24302bf52bc3
xen-libs-3.0.3-64.el5_2.9.i386.rpm	SHA-256: 6e4a540c905cb977aaf97f29a3ab0e8dad17cc9e4ad2cb22f78b4baa10343cdc

Red Hat Enterprise Linux Workstation 5

SRPM
xen-3.0.3-64.el5_2.9.src.rpm	SHA-256: 3cfa1cb443c2beedd8175e7454160fbc580b10cf102ec9021515be6b735ee6e9
x86_64
xen-3.0.3-64.el5_2.9.x86_64.rpm	SHA-256: b88338ff1da7e31c72453a71fc90fdebf7119fd1a58a26019b7d588db9f0ff1b
xen-devel-3.0.3-64.el5_2.9.i386.rpm	SHA-256: da90eec00ddc129e17bb057580a717d02844661997ec8ad544fd24302bf52bc3
xen-devel-3.0.3-64.el5_2.9.x86_64.rpm	SHA-256: 636e4cfd4bc3109a7f733f71b1ab9290f43f4153986761df193de9077076eb05
xen-libs-3.0.3-64.el5_2.9.i386.rpm	SHA-256: 6e4a540c905cb977aaf97f29a3ab0e8dad17cc9e4ad2cb22f78b4baa10343cdc
xen-libs-3.0.3-64.el5_2.9.x86_64.rpm	SHA-256: 3ebd49a0e3cc4fac528bf1284016f0875d34850787e92a117c0c36ddf4288771
i386
xen-3.0.3-64.el5_2.9.i386.rpm	SHA-256: e043f6190c6dfa0d35fd104c81f0900747651252e359e7609a5c6df6f29ae423
xen-devel-3.0.3-64.el5_2.9.i386.rpm	SHA-256: da90eec00ddc129e17bb057580a717d02844661997ec8ad544fd24302bf52bc3
xen-libs-3.0.3-64.el5_2.9.i386.rpm	SHA-256: 6e4a540c905cb977aaf97f29a3ab0e8dad17cc9e4ad2cb22f78b4baa10343cdc

Red Hat Enterprise Linux Desktop 5

SRPM
xen-3.0.3-64.el5_2.9.src.rpm	SHA-256: 3cfa1cb443c2beedd8175e7454160fbc580b10cf102ec9021515be6b735ee6e9
x86_64
xen-libs-3.0.3-64.el5_2.9.i386.rpm	SHA-256: 6e4a540c905cb977aaf97f29a3ab0e8dad17cc9e4ad2cb22f78b4baa10343cdc
xen-libs-3.0.3-64.el5_2.9.x86_64.rpm	SHA-256: 3ebd49a0e3cc4fac528bf1284016f0875d34850787e92a117c0c36ddf4288771
i386
xen-libs-3.0.3-64.el5_2.9.i386.rpm	SHA-256: 6e4a540c905cb977aaf97f29a3ab0e8dad17cc9e4ad2cb22f78b4baa10343cdc

Red Hat Enterprise Linux Server from RHUI 5

SRPM
xen-3.0.3-64.el5_2.9.src.rpm	SHA-256: 3cfa1cb443c2beedd8175e7454160fbc580b10cf102ec9021515be6b735ee6e9
x86_64
xen-libs-3.0.3-64.el5_2.9.i386.rpm	SHA-256: 6e4a540c905cb977aaf97f29a3ab0e8dad17cc9e4ad2cb22f78b4baa10343cdc
xen-libs-3.0.3-64.el5_2.9.x86_64.rpm	SHA-256: 3ebd49a0e3cc4fac528bf1284016f0875d34850787e92a117c0c36ddf4288771
i386
xen-libs-3.0.3-64.el5_2.9.i386.rpm	SHA-256: 6e4a540c905cb977aaf97f29a3ab0e8dad17cc9e4ad2cb22f78b4baa10343cdc