nathan/nixpkgs
1
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2026-09-19 22:30:23 +00:00
Code Issues Packages Projects Releases Wiki Activity

xen: patch with XSA-469

Browse Source 
Researchers at VU Amsterdam have released Training Solo, detailing
several speculative attacks which bypass current protections.

One issue, which Intel has named Indirect Target Selection, is a bug in
the hardware support for prediction-domain isolation.  The mitigation
for this involves both microcode and software changes in Xen.

For more details, see:
1.  https://vusec.net/projects/training-solo
2.  https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/advisory-guidance/indirect-target-selection.html

Another issue discussed in the Training Solo paper pertains to
classic-BPF.  Xen does not have any capability similar to BPF filters,
so is not believed to be affected by this issue.

Signed-off-by: Fernando Rodrigues <alpha@sigmasquadron.net>

(cherry picked from commit c29710d4ad)
This commit is contained in:
Fernando Rodrigues
2025-05-12 14:09:17 -03:00
parent 4d01612352
commit 4afab2e126
1 changed files with 28 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
pkgs/by-name/xe/xen/package.nix
View File

@@ -16,6 +16,34 @@ buildXenPackage.override { inherit python3Packages; } {
url = "https://xenbits.xenproject.org/xsa/xsa467.patch";
hash = "sha256-O2IwfRo6BnXAO04xjKmOyrV6J6Q1mAVLHWNCxqIEQGU=";
})
(fetchpatch {
url = "https://xenbits.xenproject.org/xsa/xsa469/xsa469-4.19-01.patch";
hash = "sha256-YUcp9QI49RM/7WCxYzpzppv+vKtyl/NvLy6rIX5hVMw=";
})
(fetchpatch {
url = "https://xenbits.xenproject.org/xsa/xsa469/xsa469-4.19-02.patch";
hash = "sha256-FTtEGAPFYxsun38hLhVMKJ1TFJOsTMK3WWPkO0R/OHg=";
})
(fetchpatch {
url = "https://xenbits.xenproject.org/xsa/xsa469/xsa469-4.19-03.patch";
hash = "sha256-UkYMSpUgFvr4GJPXLgQsCyppGkNbeiFMyCZORK5tfmA=";
})
(fetchpatch {
url = "https://xenbits.xenproject.org/xsa/xsa469/xsa469-4.19-04.patch";
hash = "sha256-lpiDPSHi+v2VfaWE9kp4+hveZKTzojD1F+RHsOtKE3A=";
})
(fetchpatch {
url = "https://xenbits.xenproject.org/xsa/xsa469/xsa469-4.19-05.patch";
hash = "sha256-EKo9a5STX0mTRopoThe3+6gCWat+3XbguLr9QgMheZs=";
})
(fetchpatch {
url = "https://xenbits.xenproject.org/xsa/xsa469/xsa469-4.19-06.patch";
hash = "sha256-HU+4apyTZNIFZ9cySOEtNh0JBJDG3LjDLwMvQYq0src=";
})
(fetchpatch {
url = "https://xenbits.xenproject.org/xsa/xsa469/xsa469-4.19-07.patch";
hash = "sha256-9S85nkQ9Nn0cMzyRe4KGrFUaLggVxXBeKhoFF4R0y78=";
})
];
rev = "ccf400846780289ae779c62ef0c94757ff43bb60";
hash = "sha256-s0eCBCd6ybl+kLtXCC6E1sk++w7txXn/B/Cg5acQFfY=";