MirageOS Security Advisory 00 - memory disclosure in mirage-net-xen
- Module: mirage-net-xen
- Announced: 2016-05-03
- Credits: Enguerrand Decorne, Thomas Leonard, Hannes Mehnert, Mindy Preston
- Affects: mirage-net-xen <1.4.2
- Corrected: 2016-01-08 1.5.0 release, 2016-05-03 1.4.2 release
For general information regarding MirageOS Security Advisories, please visit https://mirage.io/security.
Hannes published a blog article about the analysis of this issue.
MirageOS is a library operating system using cooperative multitasking, which can be executed as a guest of the Xen hypervisor. Virtual devices, such as a network device, share memory between MirageOS and the hypervisor. MirageOS allocates and grants the hypervisor access to a ringbuffer containing pages to be sent on the network device, and another ringbuffer with pages to be filled with received data. A write on the MirageOS side consists of filling the page with the packet data, submitting a write request to the hypervisor, and awaiting a response from the hypervisor. To correlate the request with the response, a 16bit identifier is used.
Generating this 16bit identifier was not done in a unique manner. When multiple pages share an identifier, and are requested to be transmitted via the wire, the first successful response will mark all pages with this identifier free, even those still waiting to be transmitted. Once marked free, the MirageOS application fills the page for another chunk of data. This leads to corrupted packets being sent, and can lead to disclosure of memory intended for another recipient.
This issue discloses memory intended for another recipient. All versions before mirage-net-xen 1.4.2 are affected. The receiving side uses a similar mechanism, which may lead to corrupted incoming data (eventually even mutated while being processed).
Version 1.5.0, released on 8th January, already assigns unique identifiers for transmission. Received pages are copied into freshly allocated buffers before passed to the next layer. When 1.5.0 was released, the impact was not clear to us. Version 1.6.1 now additionally ensures that received pages have a unique identifier.
No workaround is available.
The unique identifier is now generated in a unique manner using a monotonic counter.
Transmitting corrupt data and disclosing memory is fixed in versions 1.4.2 and above.
The recommended way to upgrade is:
opam update opam upgrade mirage-net-xen
opam upgrade opam reinstall mirage-net-xen=1.4.2
Affected releases have been marked uninstallable in the opam repository.
The following list contains the correction revision numbers for each affected branch.
Memory disclosure on transmit:
Corrupt data while receiving:
You can find the latest version of this advisory online at https://mirage.io/blog/MSA00.
This advisory is signed using OpenPGP, you can verify the signature
by downloading our public key from a keyserver (
gpg --recv-key 4A732D757C0EDA74),
downloading the raw markdown source of this advisory from GitHub
gpg --verify 00.md.asc.