Re: [Xen-devel] [PATCH XTF] CONSOLEIO_write stack overflow PoC

[Jan Beulich <jbeulich@xxxxxxxx>]

On 29.11.2019 15:35, Andrew Cooper wrote:
> Classify it as an XSA test (which arguably ought to be named 'security'),
> despite no XSA being issues.

Nit: issued

> Signed-off-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>

FWIW
Reviewed-by: Jan Beulich <jbeulich@xxxxxxxx>
with a remark and a question:

> --- a/docs/all-tests.dox
> +++ b/docs/all-tests.dox
> @@ -143,6 +143,8 @@ XSA-293 - See @ref test-pv-fsgsbase.
>  @subpage test-xsa-298 - missing descriptor table limit checking in x86 PV
>  emulation.
>  
> +@subpage test-xsa-consoleio-write - CONSOLEIO_write stack overflow
> +
>  
>  @section index-utility Utilities

Do you really want two successive blank lines there?

> --- /dev/null
> +++ b/tests/xsa-consoleio-write/main.c
> @@ -0,0 +1,69 @@
> +/**
> + * @file tests/xsa-consoleio-write/main.c
> + * @ref test-xsa-consoleio-write
> + *
> + * This issue was discovered before it made it into any released version of
> + * Xen.  Therefore, no XSA or CVE was issued.
> + *
> + * A bugfix in Xen 4.13 altered CONSOLEIO_write to tolerate passing NUL
> + * characters intact, as this is a requirement for various TTY setups.
> + *
> + * A signed-ness issue with the length calculation lead to a case where Xen
> + * will copy between 2 and 4G of guest provided data into a 128 byte object 
> on
> + * the stack.
> + *
> + * @see tests/xsa-consoleio-write/main.c
> + */
> +#include <xtf.h>
> +
> +const char test_title[] = "CONSOLEIO_write stack overflow PoC";
> +
> +uint8_t zero_page[PAGE_SIZE] __page_aligned_bss;
> +
> +/* Have the assembler build an L1/L2 pair mapping zero_page[] many times. */
> +asm (".section \".data.page_aligned\", \"aw\";"
> +     ".align 4096;"
> +
> +     "l1t:"
> +     ".rept 512;"
> +     ".long zero_page + "STR(PF_SYM(AD, P))", 0;"

There being no further (runtime) adjustment to this and ...

> +     ".endr;"
> +     ".size l1t, . - l1t;"
> +     ".type l1t, @object;"
> +
> +     "l2t:"
> +     ".rept 512;"
> +     ".long l1t + "STR(PF_SYM(AD, P))", 0;"

... this, is it set in stone that phys == lin in XTF tests? Or
did you mean this to be hvm32, not hvm32pae?

Jan

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxxx
https://lists.xenproject.org/mailman/listinfo/xen-devel