Re: [Xen-devel] [PATCH for-4.10] xen/domctl: Fix Xen heap leak via XEN_DOMCTL_getvcpucontext

[Julien Grall <julien.grall@xxxxxxxxxx>]

Hi Andrew,

On 09/10/17 11:07, Andrew Cooper wrote:
> The backing structure for XEN_DOMCTL_getvcpucontext is only zeroed in the x86
> HVM case.  At the very least, this means that ARM returns junk through its
> flags field (as it is only ever conditionally or'd into), and x86 PV leaks
> data through gdt_frames[14...15].  (An exhaustive search for other leaks
> hasn't been performed).
>
> Unconditionally zero the memory upon allocation, and forgo the double clear
> for x86 HVM.  These hypercalls are not on hotpaths.
>
> Note that this does not qualify for an XSA.  Per XSA-77,
> XEN_DOMCTL_getvcpucontext is unsafe for disaggregation, meaning that only the
> control domain can use this hypercall.
>
> Signed-off-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
> Reviewed-by: Jan Beulich <jbeulich@xxxxxxxx>
> ---
> CC: Julien Grall <julien.grall@xxxxxxx>
Release-Acked-by: Julien Grall <julien.grall@xxxxxxxxxx>

Cheers,

--
Julien Grall

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
https://lists.xen.org/xen-devel