Add web section reporting information about CVEs in QEMU
cover Add web section reporting information about CVEs in QEMU
At the QEMU maintainer's summit in Prague we discussed QEMU's woeful reporting and recording of security flaws
- No CVE information is published unless it happened to be mentioned in the commit message
- No analysis or information on when the flaw was first introduced in the code, and thus which versions are impacted
- There is no collated list of vulnerabilities
- Users / downstreams are not alerted when CVEs are fixed
- There is no description of the impact of the bug or possible workarounds that can be used
Various 3rd parties do have some of this information. For example there are various sites which collate lists of CVEs affecting projects, but the information is quite minimal usually lacking details on the impact, or possible workarounds.
Distro vendors typically look at when a flaw was introduced to determine affected versions, but this information is not recorded anywhere.
What information is found is usually free form text making it difficult to reliably process the data for analysis or reporting needs.
At the maintainer summit I volunteered address the problem of security flaw reporting for QEMU. It took a bit longer than I expected to get around it it, but I just got it working before this year's maintainer summit :-)
This series addresses the problems by adding a new section to the QEMU website with the following content:
- "Security notices" heading is added to the navigation bar
- At /secnotice/index.xml is a list of all known security flaws in a machine readable format
- At /secnotice/ is the same information in human readable HTML format, auto-generated from the XML.
- At /secnotice/$YEAR/$NUM.xml is detailed information in machine readable format for a single discovered flaw.
- At /secnotice/$YEAR/$NUM is the same information in human readable HTML format, auto-generated from the XML
- At /secnotice/$YEAR/$NUM.txt is the same information in human readable plain text format, auto-generated from the XML. This is suited for sending as email to the mailing list as an announcement.
At this point it is best to actually look at it running on a real site, so I put up a static build of the qemu-web.git content for this series
https://berrange.fedorapeople.org/qemu-sec/secnotice/
Taking one issue with multiboot from earlier this year:
https://berrange.fedorapeople.org/qemu-sec/secnotice/2018/003
https://berrange.fedorapeople.org/qemu-sec/secnotice/2018/003.txt
https://berrange.fedorapeople.org/qemu-sec/secnotice/2018/003.xml
You can see there are a few distinct pieces of content about each issue
- Lifecycle dates for
* when it was reported
* when it went public. Usually date when patch was posted for review or when it was publically mention in BZ or mailing list. Might differ from reported date if the initial reporting had an embargo.
* when the fix merged to GIT master (ie Peter applied a PULL request)
- Credits. Names / email of the people who discovered and reported the flaws, and people involved in writing patches to fix it. The latter is usually the git author.
- External references. Typically the CVE ID number, but could also be a bug tracker name + number
- Several free text blocks
* description of what the flaw is
* impact on the system when triggered/exploited
* any ways to mitigate / workaround the impact
- Git repository info
* Commit hash where the flaw was introduced
* Commit hash(s) where the flaw was fixed
* Commit hash(s) where the flaw was merged
* Tags containing the flaw on all branches
* Tags containing the fix on git master and optionally stable branches
Reporting on a new issue is fairly straightforward. The secnotice/template.xml file is cloned to the next available security notice number for the current year eg secnotice/2018/012.xml
Then it is simply a case of filling in the blanks in the template with as little or much information as is available - all the fields are optional, so can be left out if the info is not yet available.
Many key pieces of info will be available from the downstream distro vendor who coordinates with upstream. For example the Red Hat CVE links https://bugzilla.redhat.com/CVE-XXX-XXX usually contain the basic description and impact, along with dates and credit for who reported it.
The hardest part is examining the GIT history to determine when the fix was first introduced into the code. This is a case of using "git blame" to trace back where the lines of troublesome code came from - often back to the very first point the file was commited to QEMU.
Once the original commit hash is found, then there is a tool secnotice/_scripts/report-vulnerable-tags.pl which will examine git tags to determine which tags and branches contain the flaw. It will print the snippet of XML suitable for copying into the template. It can optionally accept the hash of the merge commit fixing the problem too.
After adding the new $YEAR/$ID.xml file, 'make' will build the corresponding indexes and HTML/TXT renderings. Ideally the machine which is hosting the QEMU website would run 'make' after pulling new commits. In this series, however, I have just commited the rendered content to git.
In this series I have created notices for all the CVEs I found affecting QEMU in 2018 that were listed in the Red Hat bugzilla against Fedora. I'm not entirely confident this is the full set from 2018. I fully researched the git history for each issue here and suggested mitigations where practical.
Looking back before 2018, there are ~200 further CVEs I have seen affecting QEMU. Ideally we'd create records for each of those, but that will be more time consuming and not a high priority.
Typically it has taken me about 10 minutes on average to create each CVE file, including time to find historical commits, so the extra work is quite small, especially compared to actually fixing the code. Ideally maintainers responsible for the code would create the security notice, but it could be anyone with an understanding of the issue/code.
Some ideas for future work to take advantage of the machine readable data format
- Instead of browsing a list of notices and checking each one to see if your version is affected, generate reports for each release tag in git listing the flaws that apply.
- Automated report generation
- How quickly bugs are fixed since being reported
- Which areas of code are most affected by flaws (useful for distros deciding to cull features)
- Long term rates of bug reporting (already see 2018 appears much better than 2016/2017, possibly going to be lowest number of CVEs since 2012 !)
Finally, this will all look familiar to anyone following libvirt as we use the same framework for libvirt security notices:
https://security.libvirt.org/
https://libvirt.org/git/?p=libvirt-security-notice.git;a=log
I've made a number of changes for QEMU to better suit the way QEMU works (only 1 git repo to follow, merge commits, integration with jekyll templating)
Daniel P. Berrangé (4):
Underline the current page section
Introduce content and tools for managing security notices Add vulnerability reports for 2018
Update pre-rendered content
_config.yml | 4 + _includes/nav.html | 3 +- _layouts/secnotice.html | 22 + assets/css/style-desktop.css | 2 + assets/css/style.css | 47 + secnotice/2018/001.html | 1043 +++++++++++++++++ secnotice/2018/001.txt | 210 ++++ secnotice/2018/001.xml | 248 ++++ secnotice/2018/002.html | 1044 +++++++++++++++++ secnotice/2018/002.txt | 206 ++++ secnotice/2018/002.xml | 242 ++++ secnotice/2018/003.html | 766 +++++++++++++ secnotice/2018/003.txt | 160 +++ secnotice/2018/003.xml | 191 ++++ secnotice/2018/004.html | 1045 +++++++++++++++++ secnotice/2018/004.txt | 206 ++++ secnotice/2018/004.xml | 243 ++++ secnotice/2018/005.html | 952 ++++++++++++++++ secnotice/2018/005.txt | 191 ++++ secnotice/2018/005.xml | 225 ++++ secnotice/2018/006.html | 1056 ++++++++++++++++++ secnotice/2018/006.txt | 210 ++++ secnotice/2018/006.xml | 247 ++++ secnotice/2018/007.html | 820 ++++++++++++++ secnotice/2018/007.txt | 169 +++ secnotice/2018/007.xml | 201 ++++ secnotice/2018/008.html | 952 ++++++++++++++++ secnotice/2018/008.txt | 191 ++++ secnotice/2018/008.xml | 225 ++++ secnotice/2018/009.html | 952 ++++++++++++++++ secnotice/2018/009.txt | 192 ++++ secnotice/2018/009.xml | 225 ++++ secnotice/2018/010.html | 940 ++++++++++++++++ secnotice/2018/010.txt | 188 ++++ secnotice/2018/010.xml | 223 ++++ secnotice/2018/011.html | 823 ++++++++++++++ secnotice/2018/011.txt | 169 +++ secnotice/2018/011.xml | 199 ++++ secnotice/2018/index.html | 46 + secnotice/2018/index.xml | 13 + secnotice/Makefile | 40 + secnotice/README-template.md | 78 ++ secnotice/README.md | 20 + secnotice/_scripts/index-html.xsl | 72 ++ secnotice/_scripts/index-xml | 28 + secnotice/_scripts/notice-html.xsl | 286 +++++ secnotice/_scripts/notice-txt.xsl | 277 +++++ secnotice/_scripts/report-vulnerable-tags.pl | 135 +++ secnotice/index.html | 46 + secnotice/index.xml | 13 + secnotice/template.xml | 50 + 51 files changed, 16135 insertions(+), 1 deletion(-) create mode 100644 _layouts/secnotice.html create mode 100644 secnotice/2018/001.html create mode 100644 secnotice/2018/001.txt create mode 100644 secnotice/2018/001.xml create mode 100644 secnotice/2018/002.html create mode 100644 secnotice/2018/002.txt create mode 100644 secnotice/2018/002.xml create mode 100644 secnotice/2018/003.html create mode 100644 secnotice/2018/003.txt create mode 100644 secnotice/2018/003.xml create mode 100644 secnotice/2018/004.html create mode 100644 secnotice/2018/004.txt create mode 100644 secnotice/2018/004.xml create mode 100644 secnotice/2018/005.html create mode 100644 secnotice/2018/005.txt create mode 100644 secnotice/2018/005.xml create mode 100644 secnotice/2018/006.html create mode 100644 secnotice/2018/006.txt create mode 100644 secnotice/2018/006.xml create mode 100644 secnotice/2018/007.html create mode 100644 secnotice/2018/007.txt create mode 100644 secnotice/2018/007.xml create mode 100644 secnotice/2018/008.html create mode 100644 secnotice/2018/008.txt create mode 100644 secnotice/2018/008.xml create mode 100644 secnotice/2018/009.html create mode 100644 secnotice/2018/009.txt create mode 100644 secnotice/2018/009.xml create mode 100644 secnotice/2018/010.html create mode 100644 secnotice/2018/010.txt create mode 100644 secnotice/2018/010.xml create mode 100644 secnotice/2018/011.html create mode 100644 secnotice/2018/011.txt create mode 100644 secnotice/2018/011.xml create mode 100644 secnotice/2018/index.html create mode 100644 secnotice/2018/index.xml create mode 100644 secnotice/Makefile create mode 100644 secnotice/README-template.md create mode 100644 secnotice/README.md create mode 100644 secnotice/_scripts/index-html.xsl create mode 100755 secnotice/_scripts/index-xml create mode 100644 secnotice/_scripts/notice-html.xsl create mode 100644 secnotice/_scripts/notice-txt.xsl create mode 100644 secnotice/_scripts/report-vulnerable-tags.pl create mode 100644 secnotice/index.html create mode 100644 secnotice/index.xml create mode 100644 secnotice/template.xml
Signature · 1 line
2.17.2
PATCH 1/4 Underline the current page section
The current page section is rendered in bold text but this is rather subtle to see at a glance. Add a single pixel high underline to make it more visible.
--- assets/css/style-desktop.css | 2 ++ 1 file changed, 2 insertions(+)
assets/css/style-desktop.css +2 -0
@@ -271,6 +271,8 @@ #nav li.current a { font-weight: 500; + border-bottom: 1px solid #F0A833; + padding-bottom: 2px; } /*
Signature · 1 line
2.17.2
PATCH 2/4 Introduce content and tools for managing security notices
In reply to Daniel P. Berrangé--- _config.yml | 4 + _includes/nav.html | 3 +- _layouts/secnotice.html | 22 ++ assets/css/style.css | 47 +++ secnotice/Makefile | 40 +++ secnotice/README-template.md | 78 +++++ secnotice/README.md | 20 ++ secnotice/_scripts/index-html.xsl | 72 +++++ secnotice/_scripts/index-xml | 28 ++ secnotice/_scripts/notice-html.xsl | 286 +++++++++++++++++++ secnotice/_scripts/notice-txt.xsl | 277 ++++++++++++++++++ secnotice/_scripts/report-vulnerable-tags.pl | 135 +++++++++ secnotice/template.xml | 50 ++++ 13 files changed, 1061 insertions(+), 1 deletion(-) create mode 100644 _layouts/secnotice.html create mode 100644 secnotice/Makefile create mode 100644 secnotice/README-template.md create mode 100644 secnotice/README.md create mode 100644 secnotice/_scripts/index-html.xsl create mode 100755 secnotice/_scripts/index-xml create mode 100644 secnotice/_scripts/notice-html.xsl create mode 100644 secnotice/_scripts/notice-txt.xsl create mode 100644 secnotice/_scripts/report-vulnerable-tags.pl create mode 100644 secnotice/template.xml
_config.yml +4 -0
@@ -37,3 +37,7 @@ gems: exclude: - Gemfile - Gemfile.lock + - Makefile + - secalert/README.md + - secalert/README-template.md + - secalert/template.xml
_includes/nav.html +2 -1
@@ -6,7 +6,8 @@ </li><li {% if current[1] == 'download' %}class='current'{% endif %}><a href="/download">Download</a> </li><li {% if current[1] == 'contribute' %}class='current'{% endif %}><a href="/contribute">Contribute</a> </li><li {% if current[1] == 'documentation' %}class='current'{% endif %}><a href="/documentation">Documentation</a> - </li><li {% if current[1] == 'blog' %}class='current'{% endif %}><a href="/blog">Blog</a></li> + </li><li {% if current[1] == 'blog' %}class='current'{% endif %}><a href="/blog">Blog</a> + </li><li {% if current[1] == 'secnotice' %}class='current'{% endif %}><a href="/secnotice">Security Notices</a></li> </ul> </nav>
_layouts/secnotice.html new file +22 -0
@@ -0,0 +1,22 @@ +<!DOCTYPE HTML> +<!-- +Linear by TEMPLATED +templated.co @templatedco +Released for free under the Creative Commons Attribution 3.0 license (templated.co/license) +--> +<html> +<head> + <title>{{ page.title }} - {{ site.title }}</title> + {% include assets.html %} +</head> +<body class="secnotice"> + + {% include nav.html %} + + {{ content }} + + {% include footer.html %} + {% include copyright.html %} + +</body> +</html>
assets/css/style.css +47 -0
50 lines not on this page · raw message
secnotice/Makefile new file +40 -0
@@ -0,0 +1,40 @@ + +YEARS = $(wildcard 2???) + +INDEX_XML = index.xml $(YEARS:%=%/index.xml) +INDEX_HTML = $(INDEX_XML:%.xml=%.html) + +NOTICE_XML = $(wildcard */???.xml) +NOTICE_TXT = $(NOTICE_XML:%.xml=%.txt) +NOTICE_HTML = $(NOTICE_XML:%.xml=%.html) + +all: $(INDEX_XML) $(INDEX_HTML) $(NOTICE_TXT) $(NOTICE_HTML) + +index.xml: $(NOTICE_XML) _scripts/index-xml Makefile + mkdir -p `dirname $@` + _scripts/index-xml $(sort $(NOTICE_XML)) > $@ + +index.html: index.xml _scripts/index-html.xsl Makefile + xsltproc _scripts/index-html.xsl $< > $@ + +%/index.xml: $(NOTICE_XML) _scripts/index-xml Makefile + mkdir -p `dirname $@` + DIR=`echo $@ | sed -e 's,/index.xml,,'` + rm -f $@ + _scripts/index-xml $(sort $(wildcard $(@:%/index.xml=%/)???.xml)) > $@ + +%/index.html: %/index.xml _scripts/index-html.xsl Makefile + xsltproc --stringparam permalink $(@:%/index.html=/secnotice/%/) _scripts/index-html.xsl $< > $@ + +%.txt: %.xml _scripts/notice-txt.xsl Makefile + mkdir -p `dirname $@` + xsltproc _scripts/notice-txt.xsl $< > $@ + +%.html: %.xml _scripts/notice-html.xsl Makefile + mkdir -p `dirname $@` + xsltproc _scripts/notice-html.xsl $< > $@ + +clean: + rm -rf index.{xml,html} + rm -rf */index.{xml,html} + rm -rf */*.{txt,html}
secnotice/README-template.md new file +78 -0
78 lines not on this page · raw message
secnotice/README.md new file +20 -0
@@ -0,0 +1,20 @@ +QEMU Security Notices +===================== + +This directory records all QEMU Security Notices that are issued. + +Notices must only added to this directory once any embargo is lifted, since the +GIT repository is fully public. + +Notices are written in XML in a file ``$YEAR/$NUM.xml`` eg ``2014/0001.xml``. +Assign numbers incrementally as new issues are reported. More details on the +XML format can be found in `README-schema.rst``. + +When a new notice is published for the first time, send the text rendering of +the notice to the ``[email protected]`` + +When backporting security fixes to ``stable-X.Y`` branches, update the notice +with details of the backported changeset hash. + +When doing a formal stable release, update the notices included with the release +tag name.
secnotice/_scripts/index-html.xsl new file +72 -0
72 lines not on this page · raw message
secnotice/_scripts/index-xml new file +28 -0
@@ -0,0 +1,28 @@ +#!/bin/bash +# +# Copyright (C) 2013-2014 Red Hat, Inc. +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 2 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see +# <http://www.gnu.org/licenses/>. + +set -e + +DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )" + +echo '<security-notice-list xmlns="http://qemu.org/xmlns/security-notice-list/1.0">' +for n in $@ +do + echo " <security-notice name='/secnotice/$n'/>" +done +echo '</security-notice-list>'
secnotice/_scripts/notice-html.xsl new file +286 -0
286 lines not on this page · raw message
secnotice/_scripts/notice-txt.xsl new file +277 -0
277 lines not on this page · raw message
secnotice/_scripts/report-vulnerable-tags.pl new file +135 -0
135 lines not on this page · raw message
secnotice/template.xml new file +50 -0
50 lines not on this page · raw message
Signature · 1 line
2.17.2
PATCH 3/4 Add vulnerability reports for 2018
In reply to Daniel P. Berrangé--- secnotice/2018/001.xml | 248 +++++++++++++++++++++++++++++++++++++++++ secnotice/2018/002.xml | 242 ++++++++++++++++++++++++++++++++++++++++ secnotice/2018/003.xml | 191 +++++++++++++++++++++++++++++++ secnotice/2018/004.xml | 243 ++++++++++++++++++++++++++++++++++++++++ secnotice/2018/005.xml | 225 +++++++++++++++++++++++++++++++++++++ secnotice/2018/006.xml | 247 ++++++++++++++++++++++++++++++++++++++++ secnotice/2018/007.xml | 201 +++++++++++++++++++++++++++++++++ secnotice/2018/008.xml | 225 +++++++++++++++++++++++++++++++++++++ secnotice/2018/009.xml | 225 +++++++++++++++++++++++++++++++++++++ secnotice/2018/010.xml | 223 ++++++++++++++++++++++++++++++++++++ secnotice/2018/011.xml | 199 +++++++++++++++++++++++++++++++++ 11 files changed, 2469 insertions(+) create mode 100644 secnotice/2018/001.xml create mode 100644 secnotice/2018/002.xml create mode 100644 secnotice/2018/003.xml create mode 100644 secnotice/2018/004.xml create mode 100644 secnotice/2018/005.xml create mode 100644 secnotice/2018/006.xml create mode 100644 secnotice/2018/007.xml create mode 100644 secnotice/2018/008.xml create mode 100644 secnotice/2018/009.xml create mode 100644 secnotice/2018/010.xml create mode 100644 secnotice/2018/011.xml
secnotice/2018/001.xml new file +248 -0
@@ -0,0 +1,248 @@ +<security-notice xmlns="http://qemu.org/xmlns/security-notice/1.0"> + <id>2018-001</id> + + <summary>Speculative store bypass</summary> + + <description> +<![CDATA[An industry-wide issue was found in the way many modern microprocessor designs have implemented speculative execution of Load & Store instructions (a commonly used performance optimization). + +It relies on the presence of a precisely-defined instruction sequence in the privileged code as well as the fact that memory read from address to which a recent memory write has occurred may see an older value and subsequently cause an update into the microprocessor's data cache even for speculatively executed instructions that never actually commit (retire). +]]> + </description> + + <impact> +<![CDATA[As a result, an unprivileged attacker could use this flaw to read privileged memory by conducting targeted cache side-channel attacks.]]> + </impact> + + <mitigation> +<![CDATA[None]]> + </mitigation> + + <credits> + <reporter> + <name>Ken Johnson (Microsoft Security Response Center)</name> + </reporter> + <reporter> + <name>Jann Horn (Google Project Zero)</name> + </reporter> + <patcher> + <name>Daniel P. Berrangé</name> + <email>[email protected]</email> + </patcher> + <patcher> + <name>Konrad Rzeszutek Wilk</name> + <email>[email protected]</email> + </patcher> + </credits> + + <lifecycle> + <reported>20180312</reported> + <published>20180521</published> + <fixed>20180626</fixed> + </lifecycle> + + <reference> + <advisory type="CVE" id="2018-3639"/> + </reference> + + <repository> + <branch> + <name>master</name> + <change state="fixed">d19d1f965904a533998739698020ff4ee8a103da</change> + <change state="fixed">403503b162ffc33fb64cfefdf7b880acf41772cd</change> + <change state="merged">4f50c1673a89b07f376ce5c42d22d79a79cd466d</change> + <change state="fixed">a764f3f7197f4d7ad8fe8424269933de912224cb</change> + <change state="merged">e409d9a158c77c650651e8118f6c86c8dc76eba6</change> + <tag state="fixed"></tag> + <tag state="vulnerable">v0.10.1</tag> + <tag state="vulnerable">v0.10.2</tag> + <tag state="vulnerable">v1.0</tag> + <tag state="vulnerable">v1.1.0</tag> + <tag state="vulnerable">v1.2.0</tag> + <tag state="vulnerable">v1.3.0</tag> + <tag state="vulnerable">v1.4.0</tag> + <tag state="vulnerable">v1.5.0</tag> + <tag state="vulnerable">v1.6.0</tag> + <tag state="vulnerable">v1.7.0</tag> + <tag state="vulnerable">v2.0.0</tag> + <tag state="vulnerable">v2.1.0</tag> + <tag state="vulnerable">v2.2.0</tag> + <tag state="vulnerable">v2.3.0</tag> + <tag state="vulnerable">v2.4.0</tag> + <tag state="vulnerable">v2.5.0</tag> + <tag state="vulnerable">v2.6.0</tag> + <tag state="vulnerable">v2.7.0</tag> + <tag state="vulnerable">v2.8.0</tag> + <tag state="vulnerable">v2.9.0</tag> + <tag state="vulnerable">v2.10.0</tag> + <tag state="vulnerable">v2.11.0</tag> + <tag state="vulnerable">v2.12.0</tag> + <tag state="vulnerable">v3.0.0</tag> + <change state="vulnerable">7ba1e61953f4592606e60b2e7507ff6a6faf861a</change> + </branch> + <branch> + <name>stable-0.10</name> + <tag state="vulnerable">v0.10.0</tag> + <tag state="vulnerable">v0.10.3</tag> + <tag state="vulnerable">v0.10.4</tag> + <tag state="vulnerable">v0.10.5</tag> + <tag state="vulnerable">v0.10.6</tag> + <change state="vulnerable">7ba1e61953f4592606e60b2e7507ff6a6faf861a</change> + </branch> + <branch> + <name>stable-0.11</name> + <tag state="vulnerable">v0.11.0</tag> + <tag state="vulnerable">v0.11.1</tag> + <change state="vulnerable">7ba1e61953f4592606e60b2e7507ff6a6faf861a</change> + </branch> + <branch> + <name>stable-0.12</name> + <tag state="vulnerable">v0.12.0</tag> + <tag state="vulnerable">v0.12.1</tag> + <tag state="vulnerable">v0.12.2</tag> + <tag state="vulnerable">v0.12.3</tag> + <tag state="vulnerable">v0.12.4</tag> + <tag state="vulnerable">v0.12.5</tag> + <change state="vulnerable">7ba1e61953f4592606e60b2e7507ff6a6faf861a</change> + </branch> + <branch> + <name>stable-0.13</name> + <tag state="vulnerable">v0.13.0</tag> + <change state="vulnerable">7ba1e61953f4592606e60b2e7507ff6a6faf861a</change> + </branch> + <branch> + <name>stable-0.14</name> + <tag state="vulnerable">v0.14.0</tag> + <tag state="vulnerable">v0.14.1</tag> + <change state="vulnerable">7ba1e61953f4592606e60b2e7507ff6a6faf861a</change> + </branch> + <branch> + <name>stable-0.15</name> + <tag state="vulnerable">v0.15.0</tag> + <tag state="vulnerable">v0.15.1</tag> + <change state="vulnerable">7ba1e61953f4592606e60b2e7507ff6a6faf861a</change> + </branch> + <branch> + <name>stable-1.0</name> + <tag state="vulnerable">v1.0.1</tag> + <change state="vulnerable">7ba1e61953f4592606e60b2e7507ff6a6faf861a</change> + </branch> + <branch> + <name>stable-1.1</name> + <tag state="vulnerable">v1.1.1</tag> + <tag state="vulnerable">v1.1.2</tag> + <change state="vulnerable">7ba1e61953f4592606e60b2e7507ff6a6faf861a</change> + </branch> + <branch> + <name>stable-1.2</name> + <tag state="vulnerable">v1.2.1</tag> + <tag state="vulnerable">v1.2.2</tag> + <change state="vulnerable">7ba1e61953f4592606e60b2e7507ff6a6faf861a</change> + </branch> + <branch> + <name>stable-1.3</name> + <tag state="vulnerable">v1.3.1</tag> + <change state="vulnerable">7ba1e61953f4592606e60b2e7507ff6a6faf861a</change> + </branch> + <branch> + <name>stable-1.4</name> + <tag state="vulnerable">v1.4.1</tag> + <tag state="vulnerable">v1.4.2</tag> + <change state="vulnerable">7ba1e61953f4592606e60b2e7507ff6a6faf861a</change> + </branch> + <branch> + <name>stable-1.5</name> + <tag state="vulnerable">v1.5.1</tag> + <tag state="vulnerable">v1.5.2</tag> + <tag state="vulnerable">v1.5.3</tag> + <change state="vulnerable">7ba1e61953f4592606e60b2e7507ff6a6faf861a</change> + </branch> + <branch> + <name>stable-1.6</name> + <tag state="vulnerable">v1.6.1</tag> + <tag state="vulnerable">v1.6.2</tag> + <change state="vulnerable">7ba1e61953f4592606e60b2e7507ff6a6faf861a</change> + </branch> + <branch> + <name>stable-1.7</name> + <tag state="vulnerable">v1.7.1</tag> + <tag state="vulnerable">v1.7.2</tag> + <change state="vulnerable">7ba1e61953f4592606e60b2e7507ff6a6faf861a</change> + </branch> + <branch> + <name>stable-2.0</name> + <tag state="vulnerable">v2.0.1</tag> + <tag state="vulnerable">v2.0.2</tag> + <change state="vulnerable">7ba1e61953f4592606e60b2e7507ff6a6faf861a</change> + </branch> + <branch> + <name>stable-2.1</name> + <tag state="vulnerable">v2.1.1</tag> + <tag state="vulnerable">v2.1.2</tag> + <tag state="vulnerable">v2.1.3</tag> + <change state="vulnerable">7ba1e61953f4592606e60b2e7507ff6a6faf861a</change> + </branch> + <branch> + <name>stable-2.2</name> + <tag state="vulnerable">v2.2.1</tag> + <change state="vulnerable">7ba1e61953f4592606e60b2e7507ff6a6faf861a</change> + </branch> + <branch> + <name>stable-2.3</name> + <tag state="vulnerable">v2.3.1</tag> + <change state="vulnerable">7ba1e61953f4592606e60b2e7507ff6a6faf861a</change> + </branch> + <branch> + <name>stable-2.4</name> + <tag state="vulnerable">v2.4.0.1</tag> + <tag state="vulnerable">v2.4.1</tag> + <change state="vulnerable">7ba1e61953f4592606e60b2e7507ff6a6faf861a</change> + </branch> + <branch> + <name>stable-2.5</name> + <tag state="vulnerable">v2.5.1</tag> + <tag state="vulnerable">v2.5.1.1</tag> + <change state="vulnerable">7ba1e61953f4592606e60b2e7507ff6a6faf861a</change> + </branch> + <branch> + <name>stable-2.6</name> + <tag state="vulnerable">v2.6.1</tag> + <tag state="vulnerable">v2.6.2</tag> + <change state="vulnerable">7ba1e61953f4592606e60b2e7507ff6a6faf861a</change> + </branch> + <branch> + <name>stable-2.7</name> + <tag state="vulnerable">v2.7.1</tag> + <change state="vulnerable">7ba1e61953f4592606e60b2e7507ff6a6faf861a</change> + </branch> + <branch> + <name>stable-2.8</name> + <tag state="vulnerable">v2.8.1</tag> + <tag state="vulnerable">v2.8.1.1</tag> + <change state="vulnerable">7ba1e61953f4592606e60b2e7507ff6a6faf861a</change> + </branch> + <branch> + <name>stable-2.9</name> + <tag state="vulnerable">v2.9.1</tag> + <change state="vulnerable">7ba1e61953f4592606e60b2e7507ff6a6faf861a</change> + </branch> + <branch> + <name>stable-2.10</name> + <tag state="vulnerable">v2.10.1</tag> + <tag state="vulnerable">v2.10.2</tag> + <change state="vulnerable">7ba1e61953f4592606e60b2e7507ff6a6faf861a</change> + </branch> + <branch> + <name>stable-2.11</name> + <tag state="vulnerable">v2.11.1</tag> + <tag state="vulnerable">v2.11.2</tag> + <change state="vulnerable">7ba1e61953f4592606e60b2e7507ff6a6faf861a</change> + </branch> + <branch> + <name>stable-2.12</name> + <tag state="vulnerable">v2.12.1</tag> + <change state="vulnerable">7ba1e61953f4592606e60b2e7507ff6a6faf861a</change> + </branch> + </repository> + +</security-notice>
secnotice/2018/002.xml new file +242 -0
242 lines not on this page · raw message
secnotice/2018/003.xml new file +191 -0
191 lines not on this page · raw message
secnotice/2018/004.xml new file +243 -0
243 lines not on this page · raw message
secnotice/2018/005.xml new file +225 -0
225 lines not on this page · raw message
secnotice/2018/006.xml new file +247 -0
247 lines not on this page · raw message
secnotice/2018/007.xml new file +201 -0
201 lines not on this page · raw message
secnotice/2018/008.xml new file +225 -0
225 lines not on this page · raw message
secnotice/2018/009.xml new file +225 -0
225 lines not on this page · raw message
secnotice/2018/010.xml new file +223 -0
223 lines not on this page · raw message
secnotice/2018/011.xml new file +199 -0
199 lines not on this page · raw message
Signature · 1 line
2.17.2
PATCH 4/4 Update pre-rendered content
In reply to Daniel P. Berrangé--- secnotice/2018/001.html | 1043 ++++++++++++++++++++++++++++++++++++ secnotice/2018/001.txt | 210 ++++++++ secnotice/2018/002.html | 1044 ++++++++++++++++++++++++++++++++++++ secnotice/2018/002.txt | 206 ++++++++ secnotice/2018/003.html | 766 +++++++++++++++++++++++++++ secnotice/2018/003.txt | 160 ++++++ secnotice/2018/004.html | 1045 ++++++++++++++++++++++++++++++++++++ secnotice/2018/004.txt | 206 ++++++++ secnotice/2018/005.html | 952 +++++++++++++++++++++++++++++++++ secnotice/2018/005.txt | 191 +++++++ secnotice/2018/006.html | 1056 +++++++++++++++++++++++++++++++++++++ secnotice/2018/006.txt | 210 ++++++++ secnotice/2018/007.html | 820 ++++++++++++++++++++++++++++ secnotice/2018/007.txt | 169 ++++++ secnotice/2018/008.html | 952 +++++++++++++++++++++++++++++++++ secnotice/2018/008.txt | 191 +++++++ secnotice/2018/009.html | 952 +++++++++++++++++++++++++++++++++ secnotice/2018/009.txt | 192 +++++++ secnotice/2018/010.html | 940 +++++++++++++++++++++++++++++++++ secnotice/2018/010.txt | 188 +++++++ secnotice/2018/011.html | 823 +++++++++++++++++++++++++++++ secnotice/2018/011.txt | 169 ++++++ secnotice/2018/index.html | 46 ++ secnotice/2018/index.xml | 13 + secnotice/index.html | 46 ++ secnotice/index.xml | 13 + 26 files changed, 12603 insertions(+) create mode 100644 secnotice/2018/001.html create mode 100644 secnotice/2018/001.txt create mode 100644 secnotice/2018/002.html create mode 100644 secnotice/2018/002.txt create mode 100644 secnotice/2018/003.html create mode 100644 secnotice/2018/003.txt create mode 100644 secnotice/2018/004.html create mode 100644 secnotice/2018/004.txt create mode 100644 secnotice/2018/005.html create mode 100644 secnotice/2018/005.txt create mode 100644 secnotice/2018/006.html create mode 100644 secnotice/2018/006.txt create mode 100644 secnotice/2018/007.html create mode 100644 secnotice/2018/007.txt create mode 100644 secnotice/2018/008.html create mode 100644 secnotice/2018/008.txt create mode 100644 secnotice/2018/009.html create mode 100644 secnotice/2018/009.txt create mode 100644 secnotice/2018/010.html create mode 100644 secnotice/2018/010.txt create mode 100644 secnotice/2018/011.html create mode 100644 secnotice/2018/011.txt create mode 100644 secnotice/2018/index.html create mode 100644 secnotice/2018/index.xml create mode 100644 secnotice/index.html create mode 100644 secnotice/index.xml
secnotice/2018/001.html new file +1043 -0
@@ -0,0 +1,1043 @@ +--- +title: 'QSN-2018-001: Speculative store bypass' +layout: secnotice +permalink: /secnotice/2018/001 +--- + + <div xmlns="http://www.w3.org/1999/xhtml" id="main"> + <div class="container"> + <h2>Speculative store bypass</h2> + <h3>Lifecycle</h3> + <table> + <tr> + <th>Reported on:</th> + <td>20180312</td> + </tr> + <tr> + <th>Published on:</th> + <td>20180521</td> + </tr> + <tr> + <th>Fixed on:</th> + <td>20180626</td> + </tr> + </table> + <h3>Credits</h3> + <table> + <tr> + <th>Reported by:</th> + <td> + <a href="mailto:">Ken Johnson (Microsoft Security Response Center)</a> + </td> + </tr> + <tr> + <th/> + <td> + <a href="mailto:">Jann Horn (Google Project Zero)</a> + </td> + </tr> + <tr> + <th>Patched by:</th> + <td> + <a href="mailto:[email protected]">Daniel P. Berrangé</a> + </td> + </tr> + <tr> + <th/> + <td> + <a href="mailto:[email protected]">Konrad Rzeszutek Wilk</a> + </td> + </tr> + </table> + <h3>See also</h3> + <ul> + <li> + <a href="https://nvd.nist.gov/vuln/detail/CVE-2018-3639">CVE-2018-3639</a> + </li> + </ul> + <h3>Description</h3> + <p> +An industry-wide issue was found in the way many modern microprocessor designs have implemented speculative execution of Load & Store instructions (a commonly used performance optimization). + +It relies on the presence of a precisely-defined instruction sequence in the privileged code as well as the fact that memory read from address to which a recent memory write has occurred may see an older value and subsequently cause an update into the microprocessor's data cache even for speculatively executed instructions that never actually commit (retire). + + </p> + <h3>Impact</h3> + <p> +As a result, an unprivileged attacker could use this flaw to read privileged memory by conducting targeted cache side-channel attacks. + </p> + <h3>Mitigation</h3> + <p> +None + </p> + <p class="altformat"> + Alternative formats: + <a href="/secnotice/2018/001.xml">[xml]</a> <a href="/secnotice/2018/001.txt">[text]</a></p> + </div> +</div><div xmlns="http://www.w3.org/1999/xhtml" id="sidebar"> + <div class="container"> + <section> + <header> + <h2>Related commits</h2> + </header> + <table class="repository"> + <thead> + <tr> + <th colspan="2">Branch: + <a href="http://git.qemu.org/?p=qemu.git;a=shortlog;h=refs/heads/master">master</a></th> + </tr> + </thead> + <tbody> + <tr> + <th>Fixed in:</th> + <td class="fixedtag"> + <a href="http://git.qemu.org/?p=qemu.git;a=tag;h="/> + </td> + </tr> + <tr> + <th>Fixed by:</th> + <td class="fixedcommit"> + <a href="http://git.qemu.org/?p=qemu.git;a=commit;h=d19d1f965904a533998739698020ff4ee8a103da">d19d1f965904a533998739698020ff4ee8a103da</a> + </td> + </tr> + <tr> + <th>Fixed by:</th> + <td class="fixedcommit"> + <a href="http://git.qemu.org/?p=qemu.git;a=commit;h=403503b162ffc33fb64cfefdf7b880acf41772cd">403503b162ffc33fb64cfefdf7b880acf41772cd</a> + </td> + </tr> + <tr> + <th>Fixed by:</th> + <td class="fixedcommit"> + <a href="http://git.qemu.org/?p=qemu.git;a=commit;h=a764f3f7197f4d7ad8fe8424269933de912224cb">a764f3f7197f4d7ad8fe8424269933de912224cb</a> + </td> + </tr> + <tr> + <th>Merged by:</th> + <td class="mergedcommit"> + <a href="http://git.qemu.org/?p=qemu.git;a=commit;h=4f50c1673a89b07f376ce5c42d22d79a79cd466d">4f50c1673a89b07f376ce5c42d22d79a79cd466d</a> + </td> + </tr> + <tr> + <th>Merged by:</th> + <td class="mergedcommit"> + <a href="http://git.qemu.org/?p=qemu.git;a=commit;h=e409d9a158c77c650651e8118f6c86c8dc76eba6">e409d9a158c77c650651e8118f6c86c8dc76eba6</a> + </td> + </tr> + <tr> + <th>Broken in:</th> + <td class="brokentag"> + <a href="http://git.qemu.org/?p=qemu.git;a=tag;h=v0.10.1">v0.10.1</a> + </td> + </tr> + <tr> + <th>Broken in:</th> + <td class="brokentag"> + <a href="http://git.qemu.org/?p=qemu.git;a=tag;h=v0.10.2">v0.10.2</a> + </td> + </tr> + <tr> + <th>Broken in:</th> + <td class="brokentag"> + <a href="http://git.qemu.org/?p=qemu.git;a=tag;h=v1.0">v1.0</a> + </td> + </tr> + <tr> + <th>Broken in:</th> + <td class="brokentag"> + <a href="http://git.qemu.org/?p=qemu.git;a=tag;h=v1.1.0">v1.1.0</a> + </td> + </tr> + <tr> + <th>Broken in:</th> + <td class="brokentag"> + <a href="http://git.qemu.org/?p=qemu.git;a=tag;h=v1.2.0">v1.2.0</a> + </td> + </tr> + <tr> + <th>Broken in:</th> + <td class="brokentag"> + <a href="http://git.qemu.org/?p=qemu.git;a=tag;h=v1.3.0">v1.3.0</a> + </td> + </tr> + <tr> + <th>Broken in:</th> + <td class="brokentag"> + <a href="http://git.qemu.org/?p=qemu.git;a=tag;h=v1.4.0">v1.4.0</a> + </td> + </tr> + <tr> + <th>Broken in:</th> + <td class="brokentag"> + <a href="http://git.qemu.org/?p=qemu.git;a=tag;h=v1.5.0">v1.5.0</a> + </td> + </tr> + <tr> + <th>Broken in:</th> + <td class="brokentag"> + <a href="http://git.qemu.org/?p=qemu.git;a=tag;h=v1.6.0">v1.6.0</a> + </td> + </tr> + <tr> + <th>Broken in:</th> + <td class="brokentag"> + <a href="http://git.qemu.org/?p=qemu.git;a=tag;h=v1.7.0">v1.7.0</a> + </td> + </tr> + <tr> + <th>Broken in:</th> + <td class="brokentag"> + <a href="http://git.qemu.org/?p=qemu.git;a=tag;h=v2.0.0">v2.0.0</a> + </td> + </tr> + <tr> + <th>Broken in:</th> + <td class="brokentag"> + <a href="http://git.qemu.org/?p=qemu.git;a=tag;h=v2.1.0">v2.1.0</a> + </td> + </tr> + <tr> + <th>Broken in:</th> + <td class="brokentag"> + <a href="http://git.qemu.org/?p=qemu.git;a=tag;h=v2.2.0">v2.2.0</a> + </td> + </tr> + <tr> + <th>Broken in:</th> + <td class="brokentag"> + <a href="http://git.qemu.org/?p=qemu.git;a=tag;h=v2.3.0">v2.3.0</a> + </td> + </tr> + <tr> + <th>Broken in:</th> + <td class="brokentag"> + <a href="http://git.qemu.org/?p=qemu.git;a=tag;h=v2.4.0">v2.4.0</a> + </td> + </tr> + <tr> + <th>Broken in:</th> + <td class="brokentag"> + <a href="http://git.qemu.org/?p=qemu.git;a=tag;h=v2.5.0">v2.5.0</a> + </td> + </tr> + <tr> + <th>Broken in:</th> + <td class="brokentag"> + <a href="http://git.qemu.org/?p=qemu.git;a=tag;h=v2.6.0">v2.6.0</a> + </td> + </tr> + <tr> + <th>Broken in:</th> + <td class="brokentag"> + <a href="http://git.qemu.org/?p=qemu.git;a=tag;h=v2.7.0">v2.7.0</a> + </td> + </tr> + <tr> + <th>Broken in:</th> + <td class="brokentag"> + <a href="http://git.qemu.org/?p=qemu.git;a=tag;h=v2.8.0">v2.8.0</a> + </td> + </tr> + <tr> + <th>Broken in:</th> + <td class="brokentag"> + <a href="http://git.qemu.org/?p=qemu.git;a=tag;h=v2.9.0">v2.9.0</a> + </td> + </tr> + <tr> + <th>Broken in:</th> + <td class="brokentag"> + <a href="http://git.qemu.org/?p=qemu.git;a=tag;h=v2.10.0">v2.10.0</a> + </td> + </tr> + <tr> + <th>Broken in:</th> + <td class="brokentag"> + <a href="http://git.qemu.org/?p=qemu.git;a=tag;h=v2.11.0">v2.11.0</a> + </td> + </tr> + <tr> + <th>Broken in:</th> + <td class="brokentag"> + <a href="http://git.qemu.org/?p=qemu.git;a=tag;h=v2.12.0">v2.12.0</a> + </td> + </tr> + <tr> + <th>Broken in:</th> + <td class="brokentag"> + <a href="http://git.qemu.org/?p=qemu.git;a=tag;h=v3.0.0">v3.0.0</a> + </td> + </tr> + <tr> + <th>Broken by:</th> + <td class="brokencommit"> + <a href="http://git.qemu.org/?p=qemu.git;a=commit;h=7ba1e61953f4592606e60b2e7507ff6a6faf861a">7ba1e61953f4592606e60b2e7507ff6a6faf861a</a> + </td> + </tr> + </tbody> + </table> + <table class="repository"> + <thead> + <tr> + <th colspan="2">Branch: + <a href="http://git.qemu.org/?p=qemu.git;a=shortlog;h=refs/heads/stable-0.10">stable-0.10</a></th> + </tr> + </thead> + <tbody> + <tr> + <th>Broken in:</th> + <td class="brokentag"> + <a href="http://git.qemu.org/?p=qemu.git;a=tag;h=v0.10.0">v0.10.0</a> + </td> + </tr> + <tr> + <th>Broken in:</th> + <td class="brokentag"> + <a href="http://git.qemu.org/?p=qemu.git;a=tag;h=v0.10.3">v0.10.3</a> + </td> + </tr> + <tr> + <th>Broken in:</th> + <td class="brokentag"> + <a href="http://git.qemu.org/?p=qemu.git;a=tag;h=v0.10.4">v0.10.4</a> + </td> + </tr> + <tr> + <th>Broken in:</th> + <td class="brokentag"> + <a href="http://git.qemu.org/?p=qemu.git;a=tag;h=v0.10.5">v0.10.5</a> + </td> + </tr> + <tr> + <th>Broken in:</th> + <td class="brokentag"> + <a href="http://git.qemu.org/?p=qemu.git;a=tag;h=v0.10.6">v0.10.6</a> + </td> + </tr> + <tr> + <th>Broken by:</th> + <td class="brokencommit"> + <a href="http://git.qemu.org/?p=qemu.git;a=commit;h=7ba1e61953f4592606e60b2e7507ff6a6faf861a">7ba1e61953f4592606e60b2e7507ff6a6faf861a</a> + </td> + </tr> + </tbody> + </table> + <table class="repository"> + <thead> + <tr> + <th colspan="2">Branch: + <a href="http://git.qemu.org/?p=qemu.git;a=shortlog;h=refs/heads/stable-0.11">stable-0.11</a></th> + </tr> + </thead> + <tbody> + <tr> + <th>Broken in:</th> + <td class="brokentag"> + <a href="http://git.qemu.org/?p=qemu.git;a=tag;h=v0.11.0">v0.11.0</a> + </td> + </tr> + <tr> + <th>Broken in:</th> + <td class="brokentag"> + <a href="http://git.qemu.org/?p=qemu.git;a=tag;h=v0.11.1">v0.11.1</a> + </td> + </tr> + <tr> + <th>Broken by:</th> + <td class="brokencommit"> + <a href="http://git.qemu.org/?p=qemu.git;a=commit;h=7ba1e61953f4592606e60b2e7507ff6a6faf861a">7ba1e61953f4592606e60b2e7507ff6a6faf861a</a> + </td> + </tr> + </tbody> + </table> + <table class="repository"> + <thead> + <tr> + <th colspan="2">Branch: + <a href="http://git.qemu.org/?p=qemu.git;a=shortlog;h=refs/heads/stable-0.12">stable-0.12</a></th> + </tr> + </thead> + <tbody> + <tr> + <th>Broken in:</th> + <td class="brokentag"> + <a href="http://git.qemu.org/?p=qemu.git;a=tag;h=v0.12.0">v0.12.0</a> + </td> + </tr> + <tr> + <th>Broken in:</th> + <td class="brokentag"> + <a href="http://git.qemu.org/?p=qemu.git;a=tag;h=v0.12.1">v0.12.1</a> + </td> + </tr> + <tr> + <th>Broken in:</th> + <td class="brokentag"> + <a href="http://git.qemu.org/?p=qemu.git;a=tag;h=v0.12.2">v0.12.2</a> + </td> + </tr> + <tr> + <th>Broken in:</th> + <td class="brokentag"> + <a href="http://git.qemu.org/?p=qemu.git;a=tag;h=v0.12.3">v0.12.3</a> + </td> + </tr> + <tr> + <th>Broken in:</th> + <td class="brokentag"> + <a href="http://git.qemu.org/?p=qemu.git;a=tag;h=v0.12.4">v0.12.4</a> + </td> + </tr> + <tr> + <th>Broken in:</th> + <td class="brokentag"> + <a href="http://git.qemu.org/?p=qemu.git;a=tag;h=v0.12.5">v0.12.5</a> + </td> + </tr> + <tr> + <th>Broken by:</th> + <td class="brokencommit"> + <a href="http://git.qemu.org/?p=qemu.git;a=commit;h=7ba1e61953f4592606e60b2e7507ff6a6faf861a">7ba1e61953f4592606e60b2e7507ff6a6faf861a</a> + </td> + </tr> + </tbody> + </table> + <table class="repository"> + <thead> + <tr> + <th colspan="2">Branch: + <a href="http://git.qemu.org/?p=qemu.git;a=shortlog;h=refs/heads/stable-0.13">stable-0.13</a></th> + </tr> + </thead> + <tbody> + <tr> + <th>Broken in:</th> + <td class="brokentag"> + <a href="http://git.qemu.org/?p=qemu.git;a=tag;h=v0.13.0">v0.13.0</a> + </td> + </tr> + <tr> + <th>Broken by:</th> + <td class="brokencommit"> + <a href="http://git.qemu.org/?p=qemu.git;a=commit;h=7ba1e61953f4592606e60b2e7507ff6a6faf861a">7ba1e61953f4592606e60b2e7507ff6a6faf861a</a> + </td> + </tr> + </tbody> + </table> + <table class="repository"> + <thead> + <tr> + <th colspan="2">Branch: + <a href="http://git.qemu.org/?p=qemu.git;a=shortlog;h=refs/heads/stable-0.14">stable-0.14</a></th> + </tr> + </thead> + <tbody> + <tr> + <th>Broken in:</th> + <td class="brokentag"> + <a href="http://git.qemu.org/?p=qemu.git;a=tag;h=v0.14.0">v0.14.0</a> + </td> + </tr> + <tr> + <th>Broken in:</th> + <td class="brokentag"> + <a href="http://git.qemu.org/?p=qemu.git;a=tag;h=v0.14.1">v0.14.1</a> + </td> + </tr> + <tr> + <th>Broken by:</th> + <td class="brokencommit"> + <a href="http://git.qemu.org/?p=qemu.git;a=commit;h=7ba1e61953f4592606e60b2e7507ff6a6faf861a">7ba1e61953f4592606e60b2e7507ff6a6faf861a</a> + </td> + </tr> + </tbody> + </table> + <table class="repository"> + <thead> + <tr> + <th colspan="2">Branch: + <a href="http://git.qemu.org/?p=qemu.git;a=shortlog;h=refs/heads/stable-0.15">stable-0.15</a></th> + </tr> + </thead> + <tbody> + <tr> + <th>Broken in:</th> + <td class="brokentag"> + <a href="http://git.qemu.org/?p=qemu.git;a=tag;h=v0.15.0">v0.15.0</a> + </td> + </tr> + <tr> + <th>Broken in:</th> + <td class="brokentag"> + <a href="http://git.qemu.org/?p=qemu.git;a=tag;h=v0.15.1">v0.15.1</a> + </td> + </tr> + <tr> + <th>Broken by:</th> + <td class="brokencommit"> + <a href="http://git.qemu.org/?p=qemu.git;a=commit;h=7ba1e61953f4592606e60b2e7507ff6a6faf861a">7ba1e61953f4592606e60b2e7507ff6a6faf861a</a> + </td> + </tr> + </tbody> + </table> + <table class="repository"> + <thead> + <tr> + <th colspan="2">Branch: + <a href="http://git.qemu.org/?p=qemu.git;a=shortlog;h=refs/heads/stable-1.0">stable-1.0</a></th> + </tr> + </thead> + <tbody> + <tr> + <th>Broken in:</th> + <td class="brokentag"> + <a href="http://git.qemu.org/?p=qemu.git;a=tag;h=v1.0.1">v1.0.1</a> + </td> + </tr> + <tr> + <th>Broken by:</th> + <td class="brokencommit"> + <a href="http://git.qemu.org/?p=qemu.git;a=commit;h=7ba1e61953f4592606e60b2e7507ff6a6faf861a">7ba1e61953f4592606e60b2e7507ff6a6faf861a</a> + </td> + </tr> + </tbody> + </table> + <table class="repository"> + <thead> + <tr> + <th colspan="2">Branch: + <a href="http://git.qemu.org/?p=qemu.git;a=shortlog;h=refs/heads/stable-1.1">stable-1.1</a></th> + </tr> + </thead> + <tbody> + <tr> + <th>Broken in:</th> + <td class="brokentag"> + <a href="http://git.qemu.org/?p=qemu.git;a=tag;h=v1.1.1">v1.1.1</a> + </td> + </tr> + <tr> + <th>Broken in:</th> + <td class="brokentag"> + <a href="http://git.qemu.org/?p=qemu.git;a=tag;h=v1.1.2">v1.1.2</a> + </td> + </tr> + <tr> + <th>Broken by:</th> + <td class="brokencommit"> + <a href="http://git.qemu.org/?p=qemu.git;a=commit;h=7ba1e61953f4592606e60b2e7507ff6a6faf861a">7ba1e61953f4592606e60b2e7507ff6a6faf861a</a> + </td> + </tr> + </tbody> + </table> + <table class="repository"> + <thead> + <tr> + <th colspan="2">Branch: + <a href="http://git.qemu.org/?p=qemu.git;a=shortlog;h=refs/heads/stable-1.2">stable-1.2</a></th> + </tr> + </thead> + <tbody> + <tr> + <th>Broken in:</th> + <td class="brokentag"> + <a href="http://git.qemu.org/?p=qemu.git;a=tag;h=v1.2.1">v1.2.1</a> + </td> + </tr> + <tr> + <th>Broken in:</th> + <td class="brokentag"> + <a href="http://git.qemu.org/?p=qemu.git;a=tag;h=v1.2.2">v1.2.2</a> + </td> + </tr> + <tr> + <th>Broken by:</th> + <td class="brokencommit"> + <a href="http://git.qemu.org/?p=qemu.git;a=commit;h=7ba1e61953f4592606e60b2e7507ff6a6faf861a">7ba1e61953f4592606e60b2e7507ff6a6faf861a</a> + </td> + </tr> + </tbody> + </table> + <table class="repository"> + <thead> + <tr> + <th colspan="2">Branch: + <a href="http://git.qemu.org/?p=qemu.git;a=shortlog;h=refs/heads/stable-1.3">stable-1.3</a></th> + </tr> + </thead> + <tbody> + <tr> + <th>Broken in:</th> + <td class="brokentag"> + <a href="http://git.qemu.org/?p=qemu.git;a=tag;h=v1.3.1">v1.3.1</a> + </td> + </tr> + <tr> + <th>Broken by:</th> + <td class="brokencommit"> + <a href="http://git.qemu.org/?p=qemu.git;a=commit;h=7ba1e61953f4592606e60b2e7507ff6a6faf861a">7ba1e61953f4592606e60b2e7507ff6a6faf861a</a> + </td> + </tr> + </tbody> + </table> + <table class="repository"> + <thead> + <tr> + <th colspan="2">Branch: + <a href="http://git.qemu.org/?p=qemu.git;a=shortlog;h=refs/heads/stable-1.4">stable-1.4</a></th> + </tr> + </thead> + <tbody> + <tr> + <th>Broken in:</th> + <td class="brokentag"> + <a href="http://git.qemu.org/?p=qemu.git;a=tag;h=v1.4.1">v1.4.1</a> + </td> + </tr> + <tr> + <th>Broken in:</th> + <td class="brokentag"> + <a href="http://git.qemu.org/?p=qemu.git;a=tag;h=v1.4.2">v1.4.2</a> + </td> + </tr> + <tr> + <th>Broken by:</th> + <td class="brokencommit"> + <a href="http://git.qemu.org/?p=qemu.git;a=commit;h=7ba1e61953f4592606e60b2e7507ff6a6faf861a">7ba1e61953f4592606e60b2e7507ff6a6faf861a</a> + </td> + </tr> + </tbody> + </table> + <table class="repository"> + <thead> + <tr> + <th colspan="2">Branch: + <a href="http://git.qemu.org/?p=qemu.git;a=shortlog;h=refs/heads/stable-1.5">stable-1.5</a></th> + </tr> + </thead> + <tbody> + <tr> + <th>Broken in:</th> + <td class="brokentag"> + <a href="http://git.qemu.org/?p=qemu.git;a=tag;h=v1.5.1">v1.5.1</a> + </td> + </tr> + <tr> + <th>Broken in:</th> + <td class="brokentag"> + <a href="http://git.qemu.org/?p=qemu.git;a=tag;h=v1.5.2">v1.5.2</a> + </td> + </tr> + <tr> + <th>Broken in:</th> + <td class="brokentag"> + <a href="http://git.qemu.org/?p=qemu.git;a=tag;h=v1.5.3">v1.5.3</a> + </td> + </tr> + <tr> + <th>Broken by:</th> + <td class="brokencommit"> + <a href="http://git.qemu.org/?p=qemu.git;a=commit;h=7ba1e61953f4592606e60b2e7507ff6a6faf861a">7ba1e61953f4592606e60b2e7507ff6a6faf861a</a> + </td> + </tr> + </tbody> + </table> + <table class="repository"> + <thead> + <tr> + <th colspan="2">Branch: + <a href="http://git.qemu.org/?p=qemu.git;a=shortlog;h=refs/heads/stable-1.6">stable-1.6</a></th> + </tr> + </thead> + <tbody> + <tr> + <th>Broken in:</th> + <td class="brokentag"> + <a href="http://git.qemu.org/?p=qemu.git;a=tag;h=v1.6.1">v1.6.1</a> + </td> + </tr> + <tr> + <th>Broken in:</th> + <td class="brokentag"> + <a href="http://git.qemu.org/?p=qemu.git;a=tag;h=v1.6.2">v1.6.2</a> + </td> + </tr> + <tr> + <th>Broken by:</th> + <td class="brokencommit"> + <a href="http://git.qemu.org/?p=qemu.git;a=commit;h=7ba1e61953f4592606e60b2e7507ff6a6faf861a">7ba1e61953f4592606e60b2e7507ff6a6faf861a</a> + </td> + </tr> + </tbody> + </table> + <table class="repository"> + <thead> + <tr> + <th colspan="2">Branch: + <a href="http://git.qemu.org/?p=qemu.git;a=shortlog;h=refs/heads/stable-1.7">stable-1.7</a></th> + </tr> + </thead> + <tbody> + <tr> + <th>Broken in:</th> + <td class="brokentag"> + <a href="http://git.qemu.org/?p=qemu.git;a=tag;h=v1.7.1">v1.7.1</a> + </td> + </tr> + <tr> + <th>Broken in:</th> + <td class="brokentag"> + <a href="http://git.qemu.org/?p=qemu.git;a=tag;h=v1.7.2">v1.7.2</a> + </td> + </tr> + <tr> + <th>Broken by:</th> + <td class="brokencommit"> + <a href="http://git.qemu.org/?p=qemu.git;a=commit;h=7ba1e61953f4592606e60b2e7507ff6a6faf861a">7ba1e61953f4592606e60b2e7507ff6a6faf861a</a> + </td> + </tr> + </tbody> + </table> + <table class="repository"> + <thead> + <tr> + <th colspan="2">Branch: + <a href="http://git.qemu.org/?p=qemu.git;a=shortlog;h=refs/heads/stable-2.0">stable-2.0</a></th> + </tr> + </thead> + <tbody> + <tr> + <th>Broken in:</th> + <td class="brokentag"> + <a href="http://git.qemu.org/?p=qemu.git;a=tag;h=v2.0.1">v2.0.1</a> + </td> + </tr> + <tr> + <th>Broken in:</th> + <td class="brokentag"> + <a href="http://git.qemu.org/?p=qemu.git;a=tag;h=v2.0.2">v2.0.2</a> + </td> + </tr> + <tr> + <th>Broken by:</th> + <td class="brokencommit"> + <a href="http://git.qemu.org/?p=qemu.git;a=commit;h=7ba1e61953f4592606e60b2e7507ff6a6faf861a">7ba1e61953f4592606e60b2e7507ff6a6faf861a</a> + </td> + </tr> + </tbody> + </table> + <table class="repository"> + <thead> + <tr> + <th colspan="2">Branch: + <a href="http://git.qemu.org/?p=qemu.git;a=shortlog;h=refs/heads/stable-2.1">stable-2.1</a></th> + </tr> + </thead> + <tbody> + <tr> + <th>Broken in:</th> + <td class="brokentag"> + <a href="http://git.qemu.org/?p=qemu.git;a=tag;h=v2.1.1">v2.1.1</a> + </td> + </tr> + <tr> + <th>Broken in:</th> + <td class="brokentag"> + <a href="http://git.qemu.org/?p=qemu.git;a=tag;h=v2.1.2">v2.1.2</a> + </td> + </tr> + <tr> + <th>Broken in:</th> + <td class="brokentag"> + <a href="http://git.qemu.org/?p=qemu.git;a=tag;h=v2.1.3">v2.1.3</a> + </td> + </tr> + <tr> + <th>Broken by:</th> + <td class="brokencommit"> + <a href="http://git.qemu.org/?p=qemu.git;a=commit;h=7ba1e61953f4592606e60b2e7507ff6a6faf861a">7ba1e61953f4592606e60b2e7507ff6a6faf861a</a> + </td> + </tr> + </tbody> + </table> + <table class="repository"> + <thead> + <tr> + <th colspan="2">Branch: + <a href="http://git.qemu.org/?p=qemu.git;a=shortlog;h=refs/heads/stable-2.2">stable-2.2</a></th> + </tr> + </thead> + <tbody> + <tr> + <th>Broken in:</th> + <td class="brokentag"> + <a href="http://git.qemu.org/?p=qemu.git;a=tag;h=v2.2.1">v2.2.1</a> + </td> + </tr> + <tr> + <th>Broken by:</th> + <td class="brokencommit"> + <a href="http://git.qemu.org/?p=qemu.git;a=commit;h=7ba1e61953f4592606e60b2e7507ff6a6faf861a">7ba1e61953f4592606e60b2e7507ff6a6faf861a</a> + </td> + </tr> + </tbody> + </table> + <table class="repository"> + <thead> + <tr> + <th colspan="2">Branch: + <a href="http://git.qemu.org/?p=qemu.git;a=shortlog;h=refs/heads/stable-2.3">stable-2.3</a></th> + </tr> + </thead> + <tbody> + <tr> + <th>Broken in:</th> + <td class="brokentag"> + <a href="http://git.qemu.org/?p=qemu.git;a=tag;h=v2.3.1">v2.3.1</a> + </td> + </tr> + <tr> + <th>Broken by:</th> + <td class="brokencommit"> + <a href="http://git.qemu.org/?p=qemu.git;a=commit;h=7ba1e61953f4592606e60b2e7507ff6a6faf861a">7ba1e61953f4592606e60b2e7507ff6a6faf861a</a> + </td> + </tr> + </tbody> + </table> + <table class="repository"> + <thead> + <tr> + <th colspan="2">Branch: + <a href="http://git.qemu.org/?p=qemu.git;a=shortlog;h=refs/heads/stable-2.4">stable-2.4</a></th> + </tr> + </thead> + <tbody> + <tr> + <th>Broken in:</th> + <td class="brokentag"> + <a href="http://git.qemu.org/?p=qemu.git;a=tag;h=v2.4.0.1">v2.4.0.1</a> + </td> + </tr> + <tr> + <th>Broken in:</th> + <td class="brokentag"> + <a href="http://git.qemu.org/?p=qemu.git;a=tag;h=v2.4.1">v2.4.1</a> + </td> + </tr> + <tr> + <th>Broken by:</th> + <td class="brokencommit"> + <a href="http://git.qemu.org/?p=qemu.git;a=commit;h=7ba1e61953f4592606e60b2e7507ff6a6faf861a">7ba1e61953f4592606e60b2e7507ff6a6faf861a</a> + </td> + </tr> + </tbody> + </table> + <table class="repository"> + <thead> + <tr> + <th colspan="2">Branch: + <a href="http://git.qemu.org/?p=qemu.git;a=shortlog;h=refs/heads/stable-2.5">stable-2.5</a></th> + </tr> + </thead> + <tbody> + <tr> + <th>Broken in:</th> + <td class="brokentag"> + <a href="http://git.qemu.org/?p=qemu.git;a=tag;h=v2.5.1">v2.5.1</a> + </td> + </tr> + <tr> + <th>Broken in:</th> + <td class="brokentag"> + <a href="http://git.qemu.org/?p=qemu.git;a=tag;h=v2.5.1.1">v2.5.1.1</a> + </td> + </tr> + <tr> + <th>Broken by:</th> + <td class="brokencommit"> + <a href="http://git.qemu.org/?p=qemu.git;a=commit;h=7ba1e61953f4592606e60b2e7507ff6a6faf861a">7ba1e61953f4592606e60b2e7507ff6a6faf861a</a> + </td> + </tr> + </tbody> + </table> + <table class="repository"> + <thead> + <tr> + <th colspan="2">Branch: + <a href="http://git.qemu.org/?p=qemu.git;a=shortlog;h=refs/heads/stable-2.6">stable-2.6</a></th> + </tr> + </thead> + <tbody> + <tr> + <th>Broken in:</th> + <td class="brokentag"> + <a href="http://git.qemu.org/?p=qemu.git;a=tag;h=v2.6.1">v2.6.1</a> + </td> + </tr> + <tr> + <th>Broken in:</th> + <td class="brokentag"> + <a href="http://git.qemu.org/?p=qemu.git;a=tag;h=v2.6.2">v2.6.2</a> + </td> + </tr> + <tr> + <th>Broken by:</th> + <td class="brokencommit"> + <a href="http://git.qemu.org/?p=qemu.git;a=commit;h=7ba1e61953f4592606e60b2e7507ff6a6faf861a">7ba1e61953f4592606e60b2e7507ff6a6faf861a</a> + </td> + </tr> + </tbody> + </table> + <table class="repository"> + <thead> + <tr> + <th colspan="2">Branch: + <a href="http://git.qemu.org/?p=qemu.git;a=shortlog;h=refs/heads/stable-2.7">stable-2.7</a></th> + </tr> + </thead> + <tbody> + <tr> + <th>Broken in:</th> + <td class="brokentag"> + <a href="http://git.qemu.org/?p=qemu.git;a=tag;h=v2.7.1">v2.7.1</a> + </td> + </tr> + <tr> + <th>Broken by:</th> + <td class="brokencommit"> + <a href="http://git.qemu.org/?p=qemu.git;a=commit;h=7ba1e61953f4592606e60b2e7507ff6a6faf861a">7ba1e61953f4592606e60b2e7507ff6a6faf861a</a> + </td> + </tr> + </tbody> + </table> + <table class="repository"> + <thead> + <tr> + <th colspan="2">Branch: + <a href="http://git.qemu.org/?p=qemu.git;a=shortlog;h=refs/heads/stable-2.8">stable-2.8</a></th> + </tr> + </thead> + <tbody> + <tr> + <th>Broken in:</th> + <td class="brokentag"> + <a href="http://git.qemu.org/?p=qemu.git;a=tag;h=v2.8.1">v2.8.1</a> + </td> + </tr> + <tr> + <th>Broken in:</th> + <td class="brokentag"> + <a href="http://git.qemu.org/?p=qemu.git;a=tag;h=v2.8.1.1">v2.8.1.1</a> + </td> + </tr> + <tr> + <th>Broken by:</th> + <td class="brokencommit"> + <a href="http://git.qemu.org/?p=qemu.git;a=commit;h=7ba1e61953f4592606e60b2e7507ff6a6faf861a">7ba1e61953f4592606e60b2e7507ff6a6faf861a</a> + </td> + </tr> + </tbody> + </table> + <table class="repository"> + <thead> + <tr> + <th colspan="2">Branch: + <a href="http://git.qemu.org/?p=qemu.git;a=shortlog;h=refs/heads/stable-2.9">stable-2.9</a></th> + </tr> + </thead> + <tbody> + <tr> + <th>Broken in:</th> + <td class="brokentag"> + <a href="http://git.qemu.org/?p=qemu.git;a=tag;h=v2.9.1">v2.9.1</a> + </td> + </tr> + <tr> + <th>Broken by:</th> + <td class="brokencommit"> + <a href="http://git.qemu.org/?p=qemu.git;a=commit;h=7ba1e61953f4592606e60b2e7507ff6a6faf861a">7ba1e61953f4592606e60b2e7507ff6a6faf861a</a> + </td> + </tr> + </tbody> + </table> + <table class="repository"> + <thead> + <tr> + <th colspan="2">Branch: + <a href="http://git.qemu.org/?p=qemu.git;a=shortlog;h=refs/heads/stable-2.10">stable-2.10</a></th> + </tr> + </thead> + <tbody> + <tr> + <th>Broken in:</th> + <td class="brokentag"> + <a href="http://git.qemu.org/?p=qemu.git;a=tag;h=v2.10.1">v2.10.1</a> + </td> + </tr> + <tr> + <th>Broken in:</th> + <td class="brokentag"> + <a href="http://git.qemu.org/?p=qemu.git;a=tag;h=v2.10.2">v2.10.2</a> + </td> + </tr> + <tr> + <th>Broken by:</th> + <td class="brokencommit"> + <a href="http://git.qemu.org/?p=qemu.git;a=commit;h=7ba1e61953f4592606e60b2e7507ff6a6faf861a">7ba1e61953f4592606e60b2e7507ff6a6faf861a</a> + </td> + </tr> + </tbody> + </table> + <table class="repository"> + <thead> + <tr> + <th colspan="2">Branch: + <a href="http://git.qemu.org/?p=qemu.git;a=shortlog;h=refs/heads/stable-2.11">stable-2.11</a></th> + </tr> + </thead> + <tbody> + <tr> + <th>Broken in:</th> + <td class="brokentag"> + <a href="http://git.qemu.org/?p=qemu.git;a=tag;h=v2.11.1">v2.11.1</a> + </td> + </tr> + <tr> + <th>Broken in:</th> + <td class="brokentag"> + <a href="http://git.qemu.org/?p=qemu.git;a=tag;h=v2.11.2">v2.11.2</a> + </td> + </tr> + <tr> + <th>Broken by:</th> + <td class="brokencommit"> + <a href="http://git.qemu.org/?p=qemu.git;a=commit;h=7ba1e61953f4592606e60b2e7507ff6a6faf861a">7ba1e61953f4592606e60b2e7507ff6a6faf861a</a> + </td> + </tr> + </tbody> + </table> + <table class="repository"> + <thead> + <tr> + <th colspan="2">Branch: + <a href="http://git.qemu.org/?p=qemu.git;a=shortlog;h=refs/heads/stable-2.12">stable-2.12</a></th> + </tr> + </thead> + <tbody> + <tr> + <th>Broken in:</th> + <td class="brokentag"> + <a href="http://git.qemu.org/?p=qemu.git;a=tag;h=v2.12.1">v2.12.1</a> + </td> + </tr> + <tr> + <th>Broken by:</th> + <td class="brokencommit"> + <a href="http://git.qemu.org/?p=qemu.git;a=commit;h=7ba1e61953f4592606e60b2e7507ff6a6faf861a">7ba1e61953f4592606e60b2e7507ff6a6faf861a</a> + </td> + </tr> + </tbody> + </table> + </section> + </div> +</div>
secnotice/2018/001.txt new file +210 -0
210 lines not on this page · raw message
secnotice/2018/002.html new file +1044 -0
1,044 lines not on this page · raw message
secnotice/2018/002.txt new file +206 -0
206 lines not on this page · raw message
secnotice/2018/003.html new file +766 -0
497 lines not on this page · raw message
secnotice/2018/003.txt new file +160 -0
160 lines not on this page · raw message
secnotice/2018/004.html new file +1045 -0
1,045 lines not on this page · raw message
secnotice/2018/004.txt new file +206 -0
206 lines not on this page · raw message
secnotice/2018/005.html new file +952 -0
952 lines not on this page · raw message
secnotice/2018/005.txt new file +191 -0
191 lines not on this page · raw message
secnotice/2018/006.html new file +1056 -0
1,056 lines not on this page · raw message
secnotice/2018/006.txt new file +210 -0
210 lines not on this page · raw message
secnotice/2018/007.html new file +820 -0
820 lines not on this page · raw message
secnotice/2018/007.txt new file +169 -0
169 lines not on this page · raw message
secnotice/2018/008.html new file +952 -0
952 lines not on this page · raw message
secnotice/2018/008.txt new file +191 -0
191 lines not on this page · raw message
secnotice/2018/009.html new file +952 -0
952 lines not on this page · raw message
secnotice/2018/009.txt new file +192 -0
192 lines not on this page · raw message
secnotice/2018/010.html new file +940 -0
940 lines not on this page · raw message
secnotice/2018/010.txt new file +188 -0
188 lines not on this page · raw message
secnotice/2018/011.html new file +823 -0
823 lines not on this page · raw message
secnotice/2018/011.txt new file +169 -0
169 lines not on this page · raw message
secnotice/2018/index.html new file +46 -0
46 lines not on this page · raw message
secnotice/index.html new file +46 -0
46 lines not on this page · raw message
The rest of this diff is not shown. View the raw message.
Signature · 1 line
2.17.2
Part of the diff is not shown here. View the raw message.
Quoted 6 lines · Daniel P. Berrangé
After adding the new
$YEAR/$ID.xmlfile, 'make' will build the corresponding indexes and HTML/TXT renderings. Ideally the machine which is hosting the QEMU website would run 'make' after pulling new commits. In this series, however, I have just commited the rendered content to git.
"git push" is already running Jekyll, which has a templating mechanism similar to the one used for blog posts
(https://jekyllrb.com/docs/collections/). Basically one security notice would be a file in a _secnotices directory, with the metadata in a YAML preamble like this:
---
title: Speculative store bypass
id: 2018-001
date: 2018-05-21
reported: 2018-03-12
fixed: 2018-06-26
credits:
- reporter:
- name: Ken Johnson (Microsoft Security Response Center)
- name: Jann Horn (Google Project Zero)
- patcher:
- name: Daniel P. Berrangé
email: [email protected]
- name: Konrad Rzeszutek Wilk
email: [email protected]
advisories:
- type: CVE
id: 2018-3639
branches:
- master:
state: fixed
change:
- d19d1f965904a533998739698020ff4ee8a103da: fixed
- 403503b162ffc33fb64cfefdf7b880acf41772cd: fixed
- 4f50c1673a89b07f376ce5c42d22d79a79cd466d: merged
- a764f3f7197f4d7ad8fe8424269933de912224cb: fixed
- e409d9a158c77c650651e8118f6c86c8dc76eba6: merged
- 7ba1e61953f4592606e60b2e7507ff6a6faf861a: vulnerable tag:
- v0.10.1: vulnerable
...
+---
{% contentfor description %}
An industry-wide issue was found in the way many modern microprocessor designs have implemented speculative execution of Load & Store instructions (a commonly used performance optimization).
+
+It relies on the presence of a precisely-defined instruction sequence in the privileged code as well as the fact that memory read from address to which a recent memory write has occurred may see an older value and subsequently cause an update into the microprocessor's data cache even for speculatively executed instructions that never actually commit (retire). {% endcontentfor %}
{% contentfor impact %}
As a result, an unprivileged attacker could use this flaw to read privileged memory by conducting targeted cache side-channel attacks. {% endcontentfor %}
{% contentfor mitigation %}
None
{% endcontentfor %}
(Requires the jekyll-contentblocks plugin).
I am not a YAML fan, but I still would probably have to hide if I suggested using XSLT to convert the XML files to YAML. :) Still, one question is obvious: is the XML an industry standard? That would make it more palatable...
Quoted 67 lines · Paolo Bonzini
Quoted 6 lines · Daniel P. Berrangé
After adding the new
$YEAR/$ID.xmlfile, 'make' will build the corresponding indexes and HTML/TXT renderings. Ideally the machine which is hosting the QEMU website would run 'make' after pulling new commits. In this series, however, I have just commited the rendered content to git."git push" is already running Jekyll, which has a templating mechanism similar to the one used for blog posts
(https://jekyllrb.com/docs/collections/). Basically one security notice would be a file in a_secnoticesdirectory, with the metadata in a YAML preamble like this:---
title: Speculative store bypass
id: 2018-001
date: 2018-05-21
reported: 2018-03-12
fixed: 2018-06-26credits:
- reporter:
- name: Ken Johnson (Microsoft Security Response Center)
- name: Jann Horn (Google Project Zero)
- patcher:
- name: Daniel P. Berrangé
email: [email protected]
- name: Konrad Rzeszutek Wilk
email: [email protected]advisories:
- type: CVEid: 2018-3639branches:
- master:
state: fixed
change:
-d19d1f965904a533998739698020ff4ee8a103da: fixed
-403503b162ffc33fb64cfefdf7b880acf41772cd: fixed
-4f50c1673a89b07f376ce5c42d22d79a79cd466d: merged
-a764f3f7197f4d7ad8fe8424269933de912224cb: fixed
-e409d9a158c77c650651e8118f6c86c8dc76eba6: merged
-7ba1e61953f4592606e60b2e7507ff6a6faf861a: vulnerable tag:
- v0.10.1: vulnerable
...
+---{% contentfor description %}
An industry-wide issue was found in the way many modern microprocessor designs have implemented speculative execution of Load & Store instructions (a commonly used performance optimization).(quoted diff) +2
-0+ +It relies on the presence of a precisely-defined instruction sequencein the privileged code as well as the fact that memory read from address to which a recent memory write has occurred may see an older value and subsequently cause an update into the microprocessor's data cache even for speculatively executed instructions that never actually commit (retire). {% endcontentfor %}
{% contentfor impact %}
As a result, an unprivileged attacker could use this flaw to read privileged memory by conducting targeted cache side-channel attacks. {% endcontentfor %}
Quoted 6 lines
{% contentfor mitigation %}
None
{% endcontentfor %}(Requires the jekyll-contentblocks plugin).
I really don't want to use an application specific templating system. While we're using Jekyll for the website today, I don't think it is a good idea to assume that for the longer term.
Even today I can't actually run the jekyll website on my laptop because the qemu-web content uses templating syntax from an older version of Jekyll that has been deleted in the current Jekyll versions. So I have to hack the code to remove pieces, in order to do testing.
Quoted 4 lines
I am not a YAML fan, but I still would probably have to hide if I suggested using XSLT to convert the XML files to YAML. :) Still, one question is obvious: is the XML an industry standard? That would make it more palatable...
XML itself is an industry standard, so every OS has tools for querying and transforming the documents in standard manner, which is the key thing which is appealing to me.
Even though JSON itself is a standard, there's no standard equvalent to XSLT or XPath for querying and transforming JSON. You end up having to write programs to parse, and then reformat the data in alternative formats, and the program itself has to be written portably. Document format transformation is what XSLT excells at, IMHO.
This particular XML format isn't an industry standard. NIST has an XML schema for reporting CVEs, but it only partially overlaps with the bits of data I record here. So we would have to use XML namespaces to add fields for the extra pieces we want - the GIT data is the biggest pieces.
As with many standards though, NIST schema goes for extreme generality at the cost of making it a very unfriendly document format for humans to read. So don't think I could recommend using the NIST schema as a master format - even I would hate using it. It is the kind of thing you would want to generate from our more friendly format instead.
eg compare this NIST data for a recent QEMU flaw:
<entry id="CVE-2018-5683">
<vuln:vulnerable-configuration id="http://nvd.nist.gov/"> <cpe-lang:logical-test operator="OR" negate="false"> <cpe-lang:fact-ref name="cpe:/a:qemu:qemu"/> </cpe-lang:logical-test> </vuln:vulnerable-configuration> <vuln:vulnerable-software-list> <vuln:product>cpe:/a:qemu:qemu</vuln:product> </vuln:vulnerable-software-list> <vuln:cve-id>CVE-2018-5683</vuln:cve-id> <vuln:published-datetime>2018-01-23T13:29:00.580-05:00</vuln:published-datetime> <vuln:last-modified-datetime>2018-09-07T06:29:06.303-04:00</vuln:last-modified-datetime> <vuln:cvss> <cvss:base_metrics> <cvss:score>2.1</cvss:score> <cvss:access-vector>LOCAL</cvss:access-vector> <cvss:access-complexity>LOW</cvss:access-complexity> <cvss:authentication>NONE</cvss:authentication> <cvss:confidentiality-impact>NONE</cvss:confidentiality-impact> <cvss:integrity-impact>NONE</cvss:integrity-impact> <cvss:availability-impact>PARTIAL</cvss:availability-impact> <cvss:source>http://nvd.nist.gov</cvss:source> <cvss:generated-on-datetime>2018-02-12T11:20:01.123-05:00</cvss:generated-on-datetime> </cvss:base_metrics> </vuln:cvss> <vuln:cwe id="CWE-125"/> <vuln:references xml:lang="en" reference_type="VENDOR_ADVISORY"> <vuln:source>MLIST</vuln:source> <vuln:reference href="http://www.openwall.com/lists/oss-security/2018/01/15/2" xml:lang="en">[oss-security] 20180115 CVE-2018-5683 Qemu: Out-of-bounds read in vga_draw_text routine</vuln:reference> </vuln:references> <vuln:references xml:lang="en" reference_type="VENDOR_ADVISORY"> <vuln:source>BID</vuln:source> <vuln:reference href="http://www.securityfocus.com/bid/102518" xml:lang="en">102518</vuln:reference> </vuln:references> <vuln:references xml:lang="en" reference_type="UNKNOWN"> <vuln:source>REDHAT</vuln:source> <vuln:reference href="https://access.redhat.com/errata/RHSA-2018:0816" xml:lang="en">RHSA-2018:0816</vuln:reference> </vuln:references> <vuln:references xml:lang="en" reference_type="UNKNOWN"> <vuln:source>REDHAT</vuln:source> <vuln:reference href="https://access.redhat.com/errata/RHSA-2018:1104" xml:lang="en">RHSA-2018:1104</vuln:reference> </vuln:references> <vuln:references xml:lang="en" reference_type="UNKNOWN"> <vuln:source>REDHAT</vuln:source> <vuln:reference href="https://access.redhat.com/errata/RHSA-2018:2162" xml:lang="en">RHSA-2018:2162</vuln:reference> </vuln:references> <vuln:references xml:lang="en" reference_type="UNKNOWN"> <vuln:source>MLIST</vuln:source> <vuln:reference href="https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html" xml:lang="en">[debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update</vuln:reference> </vuln:references> <vuln:references xml:lang="en" reference_type="VENDOR_ADVISORY"> <vuln:source>MLIST</vuln:source> <vuln:reference href="https://lists.gnu.org/archive/html/qemu-devel/2018-01/msg02597.html" xml:lang="en">[Qemu-devel] 20180112 Re: [Qemu-devel] [PATCH v3] vga: check the validation of memory addr when draw text</vuln:reference> </vuln:references> <vuln:references xml:lang="en" reference_type="UNKNOWN"> <vuln:source>UBUNTU</vuln:source> <vuln:reference href="https://usn.ubuntu.com/3575-1/" xml:lang="en">USN-3575-1</vuln:reference> </vuln:references> <vuln:references xml:lang="en" reference_type="UNKNOWN"> <vuln:source>DEBIAN</vuln:source> <vuln:reference href="https://www.debian.org/security/2018/dsa-4213" xml:lang="en">DSA-4213</vuln:reference> </vuln:references> <vuln:summary>The vga_draw_text function in Qemu allows local OS guest privileged users to cause a denial of service (out-of-bounds read and QEMU process crash) by leveraging improper memory address validation.</vuln:summary>
</entry>
With what I have proposed here:
<security-notice xmlns="http://qemu.org/xmlns/security-notice/1.0"> <id>2018-002</id> <summary>VGA out of bounds in vga_draw_text</summary> <description> <![CDATA[Quick Emulator(QEMU) built with the VGA emulator support is vulnerable to an out-of-bounds access issue in vga_draw_text. It could occur while updating vga display area.]]> </description> <impact> <![CDATA[A privileged user inside guest could use this flaw to crash the Qemu process resulting in DoS.]]> </impact> <mitigation> <![CDATA[Disable graphics adapters if the virtual machines can be operated via the serial console]]> </mitigation> <credits> <reporter> <name>Jiang Xin</name> <email>[email protected]</email> </reporter> <patcher> <name>Lin ZheCheng</name> <email>[email protected]</email> </patcher> </credits> <lifecycle> <reported>20171228</reported> <published>20171225</published> <fixed>20180125</fixed> </lifecycle> <reference> <advisory type="CVE" id="2018-5683"/> </reference> <repository> <branch> <name>master</name> <tag state="fixed">v2.12.0</tag> <change state="fixed">191f59dc17396bb5a8da50f8c59b6e0a430711a4</change> <change state="merged">b3bbe959b5dc3bf07041946455cc8e8d562bfd1f</change> <tag state="vulnerable">v0.4.4</tag> <tag state="vulnerable">v0.5.0</tag> ...snip... </branch> <branch> <name>stable-2.11</name> <tag state="vulnerable">v2.11.1</tag> <tag state="vulnerable">v2.11.2</tag> <change state="vulnerable">e89f66eca974d2a9d5d89271c6041daefdab2105</change> </branch> </repository> </security-notice>
Regards,
Daniel
Signature · 3 lines
|: https://berrange.com -o- https://www.flickr.com/photos/dberrange :| |: https://libvirt.org -o- https://fstop138.berrange.com :| |: https://entangle-photo.org -o- https://www.instagram.com/dberrange :|
Quoted 8 lines · Daniel P. Berrangé
I really don't want to use an application specific templating system. While we're using Jekyll for the website today, I don't think it is a good idea to assume that for the longer term.
Even today I can't actually run the jekyll website on my laptop because the qemu-web content uses templating syntax from an older version of Jekyll that has been deleted in the current Jekyll versions. So I have to hack the code to remove pieces, in order to do testing.
Note that you can use
bundle install --path .gems bundle exec jekyll serve
in order to use locally-downloaded gems.
That said, we should indeed update Jekyll to a more recent version.
Paolo