0d71e75f73
26369-libxl-devid.patch - fate##313584: pass bios information to XEN HVM guest 26554-hvm-firmware-passthrough.patch 26555-hvm-firmware-passthrough.patch 26556-hvm-firmware-passthrough.patch - Upstream patches from Jan 26516-ACPI-parse-table-retval.patch (Replaces CVE-2013-0153-xsa36.patch) 26517-AMD-IOMMU-clear-irtes.patch (Replaces CVE-2013-0153-xsa36.patch) 26518-AMD-IOMMU-disable-if-SATA-combined-mode.patch (Replaces CVE-2013-0153-xsa36.patch) 26519-AMD-IOMMU-perdev-intremap-default.patch (Replaces CVE-2013-0153-xsa36.patch) 26526-pvdrv-no-devinit.patch 26529-gcc48-build-fix.patch 26531-AMD-IOMMU-IVHD-special-missing.patch (Replaces CVE-2013-0153-xsa36.patch) 26532-AMD-IOMMU-phantom-MSI.patch 26536-xenoprof-div-by-0.patch 26576-x86-APICV-migration.patch 26577-x86-APICV-x2APIC.patch 26578-AMD-IOMMU-replace-BUG_ON.patch - bnc#797014 - no way to control live migrations 26547-tools-xc_fix_logic_error_in_stdiostream_progress.patch 26548-tools-xc_handle_tty_output_differently_in_stdiostream_progress.patch 26549-tools-xc_turn_XCFLAGS_*_into_shifts.patch 26550-tools-xc_restore_logging_in_xc_save.patch 26551-tools-xc_log_pid_in_xc_save-xc_restore_output.patch - PVonHVM: __devinit was removed in linux-3.8 OBS-URL: https://build.opensuse.org/package/show/Virtualization/xen?expand=0&rev=229
33 lines
1.0 KiB
Diff
33 lines
1.0 KiB
Diff
References: CVE-2013-0152 XSA-35 bnc#797287
|
|
|
|
# HG changeset patch
|
|
# User Ian Campbell <ian.campbell@citrix.com>
|
|
# Date 1358938044 -3600
|
|
# Node ID 621b1a889e9b120236698731e0b5ecc5b0cb1d82
|
|
# Parent 9efe4c0bf9c8d3ecf03868c69c24dad3218523a4
|
|
xen: Do not allow guests to enable nested HVM on themselves
|
|
|
|
There is no reason for this and doing so exposes a memory leak to
|
|
guests. Only toolstacks need write access to this HVM param.
|
|
|
|
This is XSA-35 / CVE-2013-0152.
|
|
|
|
Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
|
|
Acked-by: Jan Beulich <JBeulich@suse.com>
|
|
Committed-by: Jan Beulich <jbeulich@suse.com>
|
|
|
|
--- a/xen/arch/x86/hvm/hvm.c
|
|
+++ b/xen/arch/x86/hvm/hvm.c
|
|
@@ -3930,6 +3930,11 @@ long do_hvm_op(unsigned long op, XEN_GUE
|
|
rc = -EINVAL;
|
|
break;
|
|
case HVM_PARAM_NESTEDHVM:
|
|
+ if ( !IS_PRIV(current->domain) )
|
|
+ {
|
|
+ rc = -EPERM;
|
|
+ break;
|
|
+ }
|
|
#ifdef __i386__
|
|
if ( a.value )
|
|
rc = -EINVAL;
|