Unverified Commit c29710d4 authored by Fernando Rodrigues's avatar Fernando Rodrigues
Browse files

xen: patch with XSA-469 

Researchers at VU Amsterdam have released Training Solo, detailing
several speculative attacks which bypass current protections.

One issue, which Intel has named Indirect Target Selection, is a bug in
the hardware support for prediction-domain isolation.  The mitigation
for this involves both microcode and software changes in Xen.

For more details, see:
1.  https://vusec.net/projects/training-solo
2.  https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/advisory-guidance/indirect-target-selection.html



Another issue discussed in the Training Solo paper pertains to
classic-BPF.  Xen does not have any capability similar to BPF filters,
so is not believed to be affected by this issue.

Signed-off-by: default avatarFernando Rodrigues <alpha@sigmasquadron.net>
parent cff5695f

pkgs/by-name/xe/xen/package.nix

+28 −0
Original line number Diff line number Diff line
@@ -16,6 +16,34 @@ buildXenPackage.override { inherit python3Packages; } { 
      url = "https://xenbits.xenproject.org/xsa/xsa467.patch";

      hash = "sha256-O2IwfRo6BnXAO04xjKmOyrV6J6Q1mAVLHWNCxqIEQGU=";

    })

    (fetchpatch {

      url = "https://xenbits.xenproject.org/xsa/xsa469/xsa469-4.19-01.patch";

      hash = "sha256-YUcp9QI49RM/7WCxYzpzppv+vKtyl/NvLy6rIX5hVMw=";

    })

    (fetchpatch {

      url = "https://xenbits.xenproject.org/xsa/xsa469/xsa469-4.19-02.patch";

      hash = "sha256-FTtEGAPFYxsun38hLhVMKJ1TFJOsTMK3WWPkO0R/OHg=";

    })

    (fetchpatch {

      url = "https://xenbits.xenproject.org/xsa/xsa469/xsa469-4.19-03.patch";

      hash = "sha256-UkYMSpUgFvr4GJPXLgQsCyppGkNbeiFMyCZORK5tfmA=";

    })

    (fetchpatch {

      url = "https://xenbits.xenproject.org/xsa/xsa469/xsa469-4.19-04.patch";

      hash = "sha256-lpiDPSHi+v2VfaWE9kp4+hveZKTzojD1F+RHsOtKE3A=";

    })

    (fetchpatch {

      url = "https://xenbits.xenproject.org/xsa/xsa469/xsa469-4.19-05.patch";

      hash = "sha256-EKo9a5STX0mTRopoThe3+6gCWat+3XbguLr9QgMheZs=";

    })

    (fetchpatch {

      url = "https://xenbits.xenproject.org/xsa/xsa469/xsa469-4.19-06.patch";

      hash = "sha256-HU+4apyTZNIFZ9cySOEtNh0JBJDG3LjDLwMvQYq0src=";

    })

    (fetchpatch {

      url = "https://xenbits.xenproject.org/xsa/xsa469/xsa469-4.19-07.patch";

      hash = "sha256-9S85nkQ9Nn0cMzyRe4KGrFUaLggVxXBeKhoFF4R0y78=";

    })

  ];

  rev = "ccf400846780289ae779c62ef0c94757ff43bb60";

  hash = "sha256-s0eCBCd6ybl+kLtXCC6E1sk++w7txXn/B/Cg5acQFfY=";