[PATCH for-4.10] xen/domctl: Fix Xen heap leak via XEN_DOMCTL_getvcpucontext

[PATCH for-4.10] xen/domctl: Fix Xen heap leak via XEN_DOMCTL_getvcpucontext

[Andrew Cooper]

The backing structure for XEN_DOMCTL_getvcpucontext is only zeroed in the x86
HVM case.  At the very least, this means that ARM returns junk through its
flags field (as it is only ever conditionally or'd into), and x86 PV leaks
data through gdt_frames[14...15].  (An exhaustive search for other leaks
hasn't been performed).

Unconditionally zero the memory upon allocation, and forgo the double clear
for x86 HVM.  These hypercalls are not on hotpaths.

Note that this does not qualify for an XSA.  Per XSA-77,
XEN_DOMCTL_getvcpucontext is unsafe for disaggregation, meaning that only the
control domain can use this hypercall.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
---
CC: Julien Grall <julien.grall@arm.com>

This should be backported to stable branches
---
 xen/arch/x86/domctl.c | 2 --
 xen/common/domctl.c   | 2 +-
 2 files changed, 1 insertion(+), 3 deletions(-)

diff --git a/xen/arch/x86/domctl.c b/xen/arch/x86/domctl.c
index 540ba08..1b208f9 100644
--- a/xen/arch/x86/domctl.c
+++ b/xen/arch/x86/domctl.c
@@ -1530,8 +1530,6 @@ void arch_get_info_guest(struct vcpu *v, vcpu_guest_context_u c)
     bool compat = is_pv_32bit_domain(d);
 #define c(fld) (!compat ? (c.nat->fld) : (c.cmp->fld))
 
-    if ( !is_pv_domain(d) )
-        memset(c.nat, 0, sizeof(*c.nat));
     memcpy(&c.nat->fpu_ctxt, v->arch.fpu_ctxt, sizeof(c.nat->fpu_ctxt));
     c(flags = v->arch.vgc_flags & ~(VGCF_i387_valid|VGCF_in_kernel));
     if ( v->fpu_initialised )
diff --git a/xen/common/domctl.c b/xen/common/domctl.c
index d03bbf2..3c6fa4e 100644
--- a/xen/common/domctl.c
+++ b/xen/common/domctl.c
@@ -869,7 +869,7 @@ long do_domctl(XEN_GUEST_HANDLE_PARAM(xen_domctl_t) u_domctl)
                      < sizeof(struct compat_vcpu_guest_context));
 #endif
         ret = -ENOMEM;
-        if ( (c.nat = xmalloc(struct vcpu_guest_context)) == NULL )
+        if ( (c.nat = xzalloc(struct vcpu_guest_context)) == NULL )
             goto getvcpucontext_out;
 
         vcpu_pause(v);
-- 
2.1.4


_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
https://lists.xen.org/xen-devel

Re: [PATCH for-4.10] xen/domctl: Fix Xen heap leak via XEN_DOMCTL_getvcpucontext

[Julien Grall]

Hi Andrew,

On 09/10/17 11:07, Andrew Cooper wrote:
> The backing structure for XEN_DOMCTL_getvcpucontext is only zeroed in the x86
> HVM case.  At the very least, this means that ARM returns junk through its
> flags field (as it is only ever conditionally or'd into), and x86 PV leaks
> data through gdt_frames[14...15].  (An exhaustive search for other leaks
> hasn't been performed).
> 
> Unconditionally zero the memory upon allocation, and forgo the double clear
> for x86 HVM.  These hypercalls are not on hotpaths.
> 
> Note that this does not qualify for an XSA.  Per XSA-77,
> XEN_DOMCTL_getvcpucontext is unsafe for disaggregation, meaning that only the
> control domain can use this hypercall.
> 
> Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
> Reviewed-by: Jan Beulich <jbeulich@suse.com>
> ---
> CC: Julien Grall <julien.grall@arm.com>

Release-Acked-by: Julien Grall <julien.grall@linaro.org>

Cheers,

-- 
Julien Grall

_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
https://lists.xen.org/xen-devel