[Xen-changelog] [xen-4.2-testing] xen: add missing guest address range checks to XENMEM_exchange handlers

[Xen patchbot-4.2-testing <patchbot@xxxxxxx>]

# HG changeset patch
# User Jan Beulich <jbeulich@xxxxxxxx>
# Date 1354644164 0
# Node ID 83ab3cd0f8e44ad588932aba93d3b5f92a888a08
# Parent  5771c761ff1bb249dc683d7ec019d76a2a03a048
xen: add missing guest address range checks to XENMEM_exchange handlers

Ever since its existence (3.0.3 iirc) the handler for this has been
using non address range checking guest memory accessors (i.e.
the ones prefixed with two underscores) without first range
checking the accessed space (via guest_handle_okay()), allowing
a guest to access and overwrite hypervisor memory.

This is XSA-29 / CVE-2012-5513.

Signed-off-by: Jan Beulich <jbeulich@xxxxxxxx>
Acked-by: Ian Campbell <ian.campbell@xxxxxxxxxx>
Acked-by: Ian Jackson <ian.jackson@xxxxxxxxxxxxx>
Committed-by: Ian Jackson <ian.jackson.citrix.com>
---


diff -r 5771c761ff1b -r 83ab3cd0f8e4 xen/common/compat/memory.c
--- a/xen/common/compat/memory.c        Tue Dec 04 18:02:38 2012 +0000
+++ b/xen/common/compat/memory.c        Tue Dec 04 18:02:44 2012 +0000
@@ -115,6 +115,12 @@ int compat_memory_op(unsigned int cmd, X
                   (cmp.xchg.out.nr_extents << cmp.xchg.out.extent_order)) )
                 return -EINVAL;
 
+            if ( !compat_handle_okay(cmp.xchg.in.extent_start,
+                                     cmp.xchg.in.nr_extents) ||
+                 !compat_handle_okay(cmp.xchg.out.extent_start,
+                                     cmp.xchg.out.nr_extents) )
+                return -EFAULT;
+
             start_extent = cmp.xchg.nr_exchanged;
             end_extent = (COMPAT_ARG_XLAT_SIZE - sizeof(*nat.xchg)) /
                          (((1U << ABS(order_delta)) + 1) *
diff -r 5771c761ff1b -r 83ab3cd0f8e4 xen/common/memory.c
--- a/xen/common/memory.c       Tue Dec 04 18:02:38 2012 +0000
+++ b/xen/common/memory.c       Tue Dec 04 18:02:44 2012 +0000
@@ -308,6 +308,13 @@ static long memory_exchange(XEN_GUEST_HA
         goto fail_early;
     }
 
+    if ( !guest_handle_okay(exch.in.extent_start, exch.in.nr_extents) ||
+         !guest_handle_okay(exch.out.extent_start, exch.out.nr_extents) )
+    {
+        rc = -EFAULT;
+        goto fail_early;
+    }
+
     /* Only privileged guests can allocate multi-page contiguous extents. */
     if ( !multipage_allocation_permitted(current->domain,
                                          exch.in.extent_order) ||

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog