[prev in list] [next in list] [prev in thread] [next in thread] 

List:       qubes-devel
Subject:    Re: [qubes-devel] Qubes Security Bulletin #22 (Critical bug)
From:       Axon <axon () openmailbox ! org>
Date:       2015-10-29 23:13:25
Message-ID: 5632A815.5010900 () openmailbox ! org
[Download RAW message or body]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Marek Marczykowski-Górecki:
> On Thu, Oct 29, 2015 at 03:46:13PM +0100, 
> sowowsuchmailvery@onenetbeyond.org wrote:
> 
> > Hello,
> 
> > In my understanding, not even a grsec/pax kernel would have 
> > stopped this. For example Alpine Linux as dom0. Is it correct?
> 
> Yes, any protection applied by dom0 is useless here, as the 
> vulnerability allows direct escalation from any PV VM to complete 
> system control.
> 

This is the sort of insane bug that haunts Qubes users' nightmares (or
at least mine). The fact that it's been there for seven years is
almost enough to make one want to throw up one's hands and reconsider
this whole "using computers" thing.

On a more sober note, I was surprised by this comment in the QSB:

> This bug might also be considered an argument for the view of 
> ditching of para-virtualized (PV) VMs, and switch to HVMs,

Seems like many (most?) of the serious Xen bugs *before this one*
affected only HVMs. Out of the frying pan and into the fire?

> or better yet: PVH VMs for better isolation.

Sounds like the best (=least bad) option.
-----BEGIN PGP SIGNATURE-----

iQIcBAEBCgAGBQJWMqgSAAoJEJh4Btx1RPV83cUQANmNdHsn2qjgsQ8sBEi+vaWn
2xArlGwnRbGZpSlsQP4A86FjB1VBCknR0oAC6Y2R1LkT+Oe2x4dWSbLY2wCxIZ9Q
CYwZ7lht9+XFJcT2TGGNvXc7iPH5XU+gIrRIlfxty4Z5+d+w8L/d+op4R3J4cSF8
Xuvm/0VgL+L4+bTuoZRWCotuSxd0iUdqschctvTwi4jOJ3OnvDNbak5gj2LqhptS
XZ3DmdIM+zK77NPq351Ij6gMXZa8MEb6j1ozpJd29bE6C6GdUX5leCZpsq0/oqvC
W/mYAohgcKCXXdEmLnUN7dAjvl1MQMeODrl18vvpwUNIJBprL/howO/Fx6sdsLpv
YRWwa1+gwGRrgDL0FYsLv9CHY2/bkjTV1uLwXHSuMDT55z0REdNqKtcJdxfeai9e
24ZZ+92jNlMoCM7LVVensvuXmhApazKJjw43XVWUf0KyzftOWlYsQqQz6oZWWu8F
qxiUBe3RR5wSUchmKDKyeD7Xr+ePQUi8IsoDIHiJZ82CFMKNIlXOniXzYyNnl0Y6
9v+fqT/9zBPQmsxG9rItF1aqlaw/TltzsTZZkjx6XBNGucsZvxlagiMZTIsDKELD
sWmTKKs1SeKUTU+vEQaU56sK/6KEVFwR3gSrhk/vf7j1QMl/sV/lE8uCSwJwm922
wPadojoCL8hEVCVQtIwX
=Mh64
-----END PGP SIGNATURE-----

-- 
You received this message because you are subscribed to the Google Groups \
"qubes-devel" group. To unsubscribe from this group and stop receiving emails from \
it, send an email to qubes-devel+unsubscribe@googlegroups.com. To post to this group, \
send email to qubes-devel@googlegroups.com. To view this discussion on the web visit \
https://groups.google.com/d/msgid/qubes-devel/5632A815.5010900%40openmailbox.org. For \
more options, visit https://groups.google.com/d/optout.


[prev in list] [next in list] [prev in thread] [next in thread]