From 2692df2a2c6ca3c09ef6c3d064f36e3630ff9bdc Mon Sep 17 00:00:00 2001 From: Ian Jackson Date: Wed, 14 Nov 2012 11:46:35 +0000 Subject: compat/gnttab: Prevent infinite loop in compat code c/s 20281:95ea2052b41b, which introduces Grant Table version 2 hypercalls introduces a vulnerability whereby the compat hypercall handler can fall into an infinite loop. If the watchdog is enabled, Xen will die after the timeout. This is a security problem, XSA-24 / CVE-2012-4539. Signed-off-by: Andrew Cooper Acked-by: Jan Beulich Acked-by: Ian Jackson Committed-by: Ian Jackson xen-unstable changeset: 26151:b64a7d868f06 Backport-requested-by: security@xen.org Committed-by: Ian Jackson --- xen/common/compat/grant_table.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/xen/common/compat/grant_table.c b/xen/common/compat/grant_table.c index ca60395f0a..d09a65b615 100644 --- a/xen/common/compat/grant_table.c +++ b/xen/common/compat/grant_table.c @@ -310,6 +310,8 @@ int compat_grant_table_op(unsigned int cmd, #undef XLAT_gnttab_get_status_frames_HNDL_frame_list if ( unlikely(__copy_to_guest(cmp_uop, &cmp.get_status, 1)) ) rc = -EFAULT; + else + i = 1; } break; } -- cgit v1.2.3