Notification time stamped 2023-07-31 21:09:19 UTC
From 8f43f4c45b933595a24b180896034fce0b91e8bf Mon Sep 17 00:00:00 2001
From: Michael Young <m.a.young(a)durham.ac.uk>
Date: Jul 31 2023 21:08:57 +0000
Subject: bugfix for x86/AMD: Zenbleed [XSA-433, CVE-2023-20593]
---
diff --git a/xen.spec b/xen.spec
index 28c409c..96a43c7 100644
--- a/xen.spec
+++ b/xen.spec
@@ -55,7 +55,7 @@
Summary: Xen is a virtual machine monitor
Name: xen
Version: 4.16.4
-Release: 2%{?dist}
+Release: 3%{?dist}
License: GPLv2+ and LGPLv2+ and BSD
URL:
http://xen.org/
Source0:
https://downloads.xenproject.org/release/xen/%{version}/xen-%{version}.ta...
@@ -112,6 +112,7 @@ Patch44: xsa376.patch
Patch45: xen.gcc12.fixes.patch
Patch46: xen.efi.build.patch
Patch47: xsa433-4.16.patch
+Patch48: xsa433-bugfix.patch
%if %build_qemutrad
@@ -325,6 +326,7 @@ manage Xen virtual machines.
%patch45 -p1
%patch46 -p1
%patch47 -p1
+%patch48 -p1
# qemu-xen-traditional patches
pushd tools/qemu-xen-traditional
@@ -933,6 +935,9 @@ fi
%endif
%changelog
+* Mon Jul 31 2023 Michael Young <m.a.young(a)durham.ac.uk> - 4.16.4-3
+- bugfix for x86/AMD: Zenbleed [XSA-433, CVE-2023-20593]
+
* Wed Jul 26 2023 Michael Young <m.a.young(a)durham.ac.uk> - 4.16.4-2
- x86/AMD: Zenbleed [XSA-433, CVE-2023-20593]
diff --git a/xsa433-bugfix.patch b/xsa433-bugfix.patch
new file mode 100644
index 0000000..8ad4eda
--- /dev/null
+++ b/xsa433-bugfix.patch
@@ -0,0 +1,29 @@
+From: Andrew Cooper <andrew.cooper3(a)citrix.com>
+Subject: x86/amd: Fix DE_CFG truncation in amd_check_zenbleed()
+
+This line:
+
+ val &= ~chickenbit;
+
+ends up truncating val to 32 bits, and turning off various errata workarounds
+in Zen2 systems.
+
+Fixes: f91c5ea97067 ("x86/amd: Mitigations for Zenbleed")
+Signed-off-by: Andrew Cooper <andrew.cooper3(a)citrix.com>
+Reviewed-by: Jan Beulich <jbeulich(a)suse.com>
+
+diff --git a/xen/arch/x86/cpu/amd.c b/xen/arch/x86/cpu/amd.c
+index 3ed06f670491..df2681b7c455 100644
+--- a/xen/arch/x86/cpu/amd.c
++++ b/xen/arch/x86/cpu/amd.c
+@@ -909,8 +909,8 @@ void __init detect_zen2_null_seg_behaviour(void)
+ void amd_check_zenbleed(void)
+ {
+ const struct cpu_signature *sig = &this_cpu(cpu_sig);
+- unsigned int good_rev, chickenbit = (1 << 9);
+- uint64_t val, old_val;
++ unsigned int good_rev;
++ uint64_t val, old_val, chickenbit = (1 << 9);
+
+ /*
+ * If we're virtualised, we can't do family/model checks safely, and
https://src.fedoraproject.org/rpms/xen/c/8f43f4c45b933595a24b180896034fce...