diff options
| author | Jan Beulich <jbeulich@suse.com> | 2012-12-04 18:49:56 +0000 |
|---|---|---|
| committer | Jan Beulich <jbeulich@suse.com> | 2012-12-04 18:49:56 +0000 |
| commit | 778b7171ca02e9f6eec3b56d2b23e0691839edf5 (patch) | |
| tree | 2a1e4a20b13b3cafd5e9ebe539b1118a6a5e53aa | |
| parent | 358ee1ae1b89e586721ca442bcab708dd4b7922d (diff) | |
| download | xen-778b7171ca02e9f6eec3b56d2b23e0691839edf5.tar.gz xen-778b7171ca02e9f6eec3b56d2b23e0691839edf5.tar.bz2 xen-778b7171ca02e9f6eec3b56d2b23e0691839edf5.zip | |
xen: add missing guest address range checks to XENMEM_exchange handlers
Ever since its existence (3.0.3 iirc) the handler for this has been
using non address range checking guest memory accessors (i.e.
the ones prefixed with two underscores) without first range
checking the accessed space (via guest_handle_okay()), allowing
a guest to access and overwrite hypervisor memory.
This is XSA-29 / CVE-2012-5513.
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
Acked-by: Ian Jackson <ian.jackson@eu.citrix.com>
Committed-by: Ian Jackson <ian.jackson.citrix.com>
| -rw-r--r-- | xen/common/compat/memory.c | 6 | ||||
| -rw-r--r-- | xen/common/memory.c | 7 |
2 files changed, 13 insertions, 0 deletions
diff --git a/xen/common/compat/memory.c b/xen/common/compat/memory.c index 2402984f1e..1d877fc021 100644 --- a/xen/common/compat/memory.c +++ b/xen/common/compat/memory.c @@ -114,6 +114,12 @@ int compat_memory_op(unsigned int cmd, XEN_GUEST_HANDLE(void) compat) (cmp.xchg.out.nr_extents << cmp.xchg.out.extent_order)) ) return -EINVAL; + if ( !compat_handle_okay(cmp.xchg.in.extent_start, + cmp.xchg.in.nr_extents) || + !compat_handle_okay(cmp.xchg.out.extent_start, + cmp.xchg.out.nr_extents) ) + return -EFAULT; + start_extent = cmp.xchg.nr_exchanged; end_extent = (COMPAT_ARG_XLAT_SIZE - sizeof(*nat.xchg)) / (((1U << ABS(order_delta)) + 1) * diff --git a/xen/common/memory.c b/xen/common/memory.c index 4e7c2340c3..59379d3607 100644 --- a/xen/common/memory.c +++ b/xen/common/memory.c @@ -289,6 +289,13 @@ static long memory_exchange(XEN_GUEST_HANDLE(xen_memory_exchange_t) arg) goto fail_early; } + if ( !guest_handle_okay(exch.in.extent_start, exch.in.nr_extents) || + !guest_handle_okay(exch.out.extent_start, exch.out.nr_extents) ) + { + rc = -EFAULT; + goto fail_early; + } + /* Only privileged guests can allocate multi-page contiguous extents. */ if ( !multipage_allocation_permitted(current->domain, exch.in.extent_order) || |