CVE-2012-2625 / CVE-2012-4544

Debian Bug report logs - #688125
CVE-2012-2625 / CVE-2012-4544

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Moritz Muehlenhoff <jmm@inutil.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: xen: CVE-2012-2625

Date: Wed, 19 Sep 2012 17:33:41 +0200

Package: xen
Severity: important
Tags: security
Justification: user security hole

Hi,
This issue is still unfixed in Wheezy:

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-2625

Patch:
http://xenbits.xensource.com/hg/xen-unstable.hg/rev/60f09d1ab1fe

Cheers,
        Moritz

Message #10 received at 688125-done@bugs.debian.org (full text, mbox, reply):

From: Bastian Blank <waldi@debian.org>

To: 688125-done@bugs.debian.org

Subject: Re: [Pkg-xen-devel] Bug#688125: xen: CVE-2012-2625

Date: Wed, 19 Sep 2012 17:47:51 +0200

On Wed, Sep 19, 2012 at 05:33:41PM +0200, Moritz Muehlenhoff wrote:
> This issue is still unfixed in Wheezy:
> https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-2625
> http://xenbits.xensource.com/hg/xen-unstable.hg/rev/60f09d1ab1fe

Two different problems. No known patch for the first one.

Bastian

-- 
Peace was the way.
		-- Kirk, "The City on the Edge of Forever", stardate unknown

Message #15 received at 688125@bugs.debian.org (full text, mbox, reply):

From: Ian Campbell <ijc@hellion.org.uk>

To: 688125@bugs.debian.org

Cc: Bastian Blank <waldi@debian.org>

Subject: Re: [Pkg-xen-devel] Bug#688125: marked as done (xen: CVE-2012-2625)

Date: Fri, 21 Sep 2012 09:40:27 +0100

On Wed, 2012-09-19 at 15:51 +0000, Debian Bug Tracking System wrote:
> > On Wed, Sep 19, 2012 at 05:33:41PM +0200, Moritz Muehlenhoff wrote:
> > > This issue is still unfixed in Wheezy:
> > > https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-2625
> > > http://xenbits.xensource.com/hg/xen-unstable.hg/rev/60f09d1ab1fe
> > 
> > Two different problems. No known patch for the first one.

Wrong. 

60f09d1ab1fe is the fix for precisely the issue described in
CVE-2012-2625.

If you think there is another issue then please tell us about it (on
security@xen.org if you prefer).

Ian.

-- 
Ian Campbell
Current Noise: Bastard Priest - Evil Pain

Give me a sleeping pill and tell me your troubles.

Message #22 received at 688125@bugs.debian.org (full text, mbox, reply):

From: Bastian Blank <waldi@debian.org>

To: Ian Campbell <ijc@hellion.org.uk>, 688125@bugs.debian.org

Subject: Re: [Pkg-xen-devel] Bug#688125: Bug#688125: marked as done (xen: CVE-2012-2625)

Date: Fri, 21 Sep 2012 14:23:13 +0200

On Fri, Sep 21, 2012 at 09:40:27AM +0100, Ian Campbell wrote:
> On Wed, 2012-09-19 at 15:51 +0000, Debian Bug Tracking System wrote:
> > > On Wed, Sep 19, 2012 at 05:33:41PM +0200, Moritz Muehlenhoff wrote:
> > > > This issue is still unfixed in Wheezy:
> > > > https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-2625
> > > > http://xenbits.xensource.com/hg/xen-unstable.hg/rev/60f09d1ab1fe
> > > Two different problems. No known patch for the first one.
> 60f09d1ab1fe is the fix for precisely the issue described in
> CVE-2012-2625.

The referenced bug marked with CVE-2012-2625 speaks about the pv loader
for bzip2 and lzma kernels. This loader is implemented in libxenctrl and
the hypervisor for dom0. I see no mitigation in this code against large
decompressed files. Plus there is an integer overflow.

60f09d1ab1fe fixes reading too large files from guest filesystems using
pygrub.

Bastian

-- 
But Captain -- the engines can't take this much longer!

Message #27 received at 688125-done@bugs.debian.org (full text, mbox, reply):

From: Bastian Blank <waldi@debian.org>

To: Ian Campbell <ijc@hellion.org.uk>, 688125-done@bugs.debian.org

Subject: Re: [Pkg-xen-devel] Bug#688125: Bug#688125: Bug#688125: marked as done (xen: CVE-2012-2625)

Date: Sun, 7 Oct 2012 18:07:31 +0200

On Fri, Sep 21, 2012 at 02:23:13PM +0200, Bastian Blank wrote:
> The referenced bug marked with CVE-2012-2625 speaks about the pv loader
> for bzip2 and lzma kernels. This loader is implemented in libxenctrl and
> the hypervisor for dom0. I see no mitigation in this code against large
> decompressed files. Plus there is an integer overflow.
> 
> 60f09d1ab1fe fixes reading too large files from guest filesystems using
> pygrub.

I received no further information. Please reopen _after_ you figured
out, which one this is and this information got published in the CVE
list.

Bastian

-- 
Worlds are conquered, galaxies destroyed -- but a woman is always a woman.
		-- Kirk, "The Conscience of the King", stardate 2818.9

Message #32 received at 688125@bugs.debian.org (full text, mbox, reply):

From: Moritz Muehlenhoff <jmm@inutil.org>

To: Bastian Blank <waldi@debian.org>

Cc: Ian Campbell <ijc@hellion.org.uk>, 688125@bugs.debian.org, control@bugs.debian.org

Subject: Re: [Pkg-xen-devel] Bug#688125: Bug#688125: Bug#688125: marked as done (xen: CVE-2012-2625)

Date: Mon, 29 Oct 2012 09:38:18 +0100

reopen 688125
retitle 688125 CVE-2012-2625 / CVE-2012-4544
thanks

On Sun, Oct 07, 2012 at 06:07:31PM +0200, Bastian Blank wrote:
> On Fri, Sep 21, 2012 at 02:23:13PM +0200, Bastian Blank wrote:
> > The referenced bug marked with CVE-2012-2625 speaks about the pv loader
> > for bzip2 and lzma kernels. This loader is implemented in libxenctrl and
> > the hypervisor for dom0. I see no mitigation in this code against large
> > decompressed files. Plus there is an integer overflow.
> > 
> > 60f09d1ab1fe fixes reading too large files from guest filesystems using
> > pygrub.
> 
> I received no further information. Please reopen _after_ you figured
> out, which one this is and this information got published in the CVE
> list.

Please see http://lists.xen.org/archives/html/xen-devel/2012-10/msg02015.html
for clarification

Cheers,
        Moritz

Message #41 received at 688125-done@bugs.debian.org (full text, mbox, reply):

From: Bastian Blank <waldi@debian.org>

To: 688125-done@bugs.debian.org

Subject: fixed

Date: Thu, 31 Jan 2013 15:14:50 +0100

Version: 4.1.3-4
-- 
Killing is stupid; useless!
		-- McCoy, "A Private Little War", stardate 4211.8

Send a report that this bug log contains spam.