[Xen-changelog] [xen stable-4.8] xen/domctl: Fix Xen heap leak via XEN_DOMCTL_getvcpucontext

[patchbot@xxxxxxx]

commit 011a612fa2aab667a097dc4bcbb4ccf81bbe6b1d
Author:     Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
AuthorDate: Tue Oct 24 16:26:03 2017 +0200
Commit:     Jan Beulich <jbeulich@xxxxxxxx>
CommitDate: Tue Oct 24 16:26:03 2017 +0200

    xen/domctl: Fix Xen heap leak via XEN_DOMCTL_getvcpucontext
    
    The backing structure for XEN_DOMCTL_getvcpucontext is only zeroed in the 
x86
    HVM case.  At the very least, this means that ARM returns junk through its
    flags field (as it is only ever conditionally or'd into), and x86 PV leaks
    data through gdt_frames[14...15].  (An exhaustive search for other leaks
    hasn't been performed).
    
    Unconditionally zero the memory upon allocation, and forgo the double clear
    for x86 HVM.  These hypercalls are not on hotpaths.
    
    Note that this does not qualify for an XSA.  Per XSA-77,
    XEN_DOMCTL_getvcpucontext is unsafe for disaggregation, meaning that only 
the
    control domain can use this hypercall.
    
    Signed-off-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
    Reviewed-by: Jan Beulich <jbeulich@xxxxxxxx>
    master commit: 3b2eeb7412e529f38d1e8b872ba0bc6ab09a7008
    master date: 2017-10-09 12:43:21 +0100
---
 xen/arch/x86/domctl.c | 2 --
 xen/common/domctl.c   | 2 +-
 2 files changed, 1 insertion(+), 3 deletions(-)

diff --git a/xen/arch/x86/domctl.c b/xen/arch/x86/domctl.c
index 2a2fe04..d32e70e 100644
--- a/xen/arch/x86/domctl.c
+++ b/xen/arch/x86/domctl.c
@@ -1454,8 +1454,6 @@ void arch_get_info_guest(struct vcpu *v, 
vcpu_guest_context_u c)
     bool_t compat = is_pv_32bit_domain(d) || is_pvh_32bit_domain(d);
 #define c(fld) (!compat ? (c.nat->fld) : (c.cmp->fld))
 
-    if ( !is_pv_domain(d) )
-        memset(c.nat, 0, sizeof(*c.nat));
     memcpy(&c.nat->fpu_ctxt, v->arch.fpu_ctxt, sizeof(c.nat->fpu_ctxt));
     c(flags = v->arch.vgc_flags & ~(VGCF_i387_valid|VGCF_in_kernel));
     if ( v->fpu_initialised )
diff --git a/xen/common/domctl.c b/xen/common/domctl.c
index b0ee961..858f377 100644
--- a/xen/common/domctl.c
+++ b/xen/common/domctl.c
@@ -875,7 +875,7 @@ long do_domctl(XEN_GUEST_HANDLE_PARAM(xen_domctl_t) 
u_domctl)
                      < sizeof(struct compat_vcpu_guest_context));
 #endif
         ret = -ENOMEM;
-        if ( (c.nat = xmalloc(struct vcpu_guest_context)) == NULL )
+        if ( (c.nat = xzalloc(struct vcpu_guest_context)) == NULL )
             goto getvcpucontext_out;
 
         vcpu_pause(v);
--
generated by git-patchbot for /home/xen/git/xen.git#stable-4.8

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxx
https://lists.xenproject.org/xen-changelog