27 lines
818 B
Diff
27 lines
818 B
Diff
|
References: CVE-2013-0152 XSA-35 bnc#797287
|
||
|
|
|
||
|
|
xen: Do not allow guests to enable nested HVM on themselves
|
||
|
|
|
||
|
|
There is no reason for this and doing so exposes a memory leak to
|
||
|
|
guests. Only toolstacks need write access to this HVM param.
|
||
|
|
|
||
|
|
This is XSA-35 / CVE-2013-0152.
|
||
|
|
|
||
|
|
Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
|
||
|
|
Acked-by: Jan Beulich <JBeulich@suse.com>
|
||
|
|
|
||
|
|
--- a/xen/arch/x86/hvm/hvm.c
|
||
|
|
+++ b/xen/arch/x86/hvm/hvm.c
|
||
|
|
@@ -3930,6 +3930,11 @@ long do_hvm_op(unsigned long op, XEN_GUE
|
||
|
|
rc = -EINVAL;
|
||
|
|
break;
|
||
|
|
case HVM_PARAM_NESTEDHVM:
|
||
|
|
+ if ( !IS_PRIV(current->domain) )
|
||
|
|
+ {
|
||
|
|
+ rc = -EPERM;
|
||
|
|
+ break;
|
||
|
|
+ }
|
||
|
|
#ifdef __i386__
|
||
|
|
if ( a.value )
|
||
|
|
rc = -EINVAL;
|