[prev in list] [next in list] [prev in thread] [next in thread] 

List:       xen-cvs
Subject:    [Xen-changelog] [xen stable-4.3] x86: restrict XEN_DOMCTL_getmemlist
From:       patchbot () xen ! org
Date:       2013-11-28 3:22:03
Message-ID: E1VlsB1-0003Zb-BA () xenbits ! xen ! org
[Download RAW message or body]

commit 9229cff72fd9490c103ebf644e432bb6c4fb69c5
Author:     Jan Beulich <jbeulich@suse.com>
AuthorDate: Wed Nov 27 09:44:02 2013 +0100
Commit:     Jan Beulich <jbeulich@suse.com>
CommitDate: Wed Nov 27 09:44:02 2013 +0100

    x86: restrict XEN_DOMCTL_getmemlist
    
    Coverity ID 1055652
    
    (See the code comment.)
    
    This is CVE-2013-4553 / XSA-74.
    
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
    Reviewed-by: Tim Deegan <tim@xen.org>
    master commit: 19f027cc5daff4a37fd0a28bca2514c721852dd0
    master date: 2013-11-27 09:00:41 +0100
---
 xen/arch/x86/domctl.c |   20 ++++++++++++++++++++
 1 files changed, 20 insertions(+), 0 deletions(-)

diff --git a/xen/arch/x86/domctl.c b/xen/arch/x86/domctl.c
index e75918a..9d67c2e 100644
--- a/xen/arch/x86/domctl.c
+++ b/xen/arch/x86/domctl.c
@@ -329,6 +329,26 @@ long arch_do_domctl(
             break;
         }
 
+        /*
+         * XSA-74: This sub-hypercall is broken in several ways:
+         * - lock order inversion (p2m locks inside page_alloc_lock)
+         * - no preemption on huge max_pfns input
+         * - not (re-)checking d->is_dying with page_alloc_lock held
+         * - not honoring start_pfn input (which libxc also doesn't set)
+         * Additionally it is rather useless, as the result is stale by the
+         * time the caller gets to look at it.
+         * As it only has a single, non-production consumer (xen-mceinj),
+         * rather than trying to fix it we restrict it for the time being.
+         */
+        if ( /* No nested locks inside copy_to_guest_offset(). */
+             paging_mode_external(current->domain) ||
+             /* Arbitrary limit capping processing time. */
+             max_pfns > GB(4) / PAGE_SIZE )
+        {
+            ret = -EOPNOTSUPP;
+            break;
+        }
+
         spin_lock(&d->page_alloc_lock);
 
         ret = i = 0;
--
generated by git-patchbot for /home/xen/git/xen.git#stable-4.3

_______________________________________________
Xen-changelog mailing list
Xen-changelog@lists.xen.org
http://lists.xensource.com/xen-changelog
[prev in list] [next in list] [prev in thread] [next in thread]