39134eb9d2
on invalid state load CVE-2013-4539-qemut-tsc210x-fix-buffer-overrun-on-invalid-state-load.patch - bsc#962632 - VUL-0: CVE-2015-1779: xen: vnc: insufficient resource limiting in VNC websockets decoder CVE-2015-1779-qemuu-limit-size-of-HTTP-headers-from-websockets-clients.patch CVE-2015-1779-qemuu-incrementally-decode-websocket-frames.patch - bsc#962642 - VUL-0: CVE-2013-4537: xen: ssi-sd: buffer overrun on invalid state load CVE-2013-4537-qemut-ssi-sd-fix-buffer-overrun-on-invalid-state-load.patch - bsc#962627 - VUL-0: CVE-2014-7815: xen: vnc: insufficient bits_per_pixel from the client sanitization CVE-2014-7815-qemut-vnc-sanitize-bits_per_pixel-from-the-client.patch - bsc#962335 - VUL-0: CVE-2013-4538: xen: ssd0323: fix buffer overun on invalid state CVE-2013-4538-qemut-ssd0323-fix-buffer-overun-on-invalid-state.patch - bsc#962360 - VUL-0: CVE-2015-7512: xen: net: pcnet: buffer overflow in non-loopback mode CVE-2015-7512-qemuu-net-pcnet-buffer-overflow-in-non-loopback-mode.patch CVE-2015-7512-qemut-net-pcnet-buffer-overflow-in-non-loopback-mode.patch - bsc#961692 - VUL-0: CVE-2016-1714: xen: nvram: OOB r/w access in processing firmware configurations CVE-2016-1714-qemuu-fw_cfg-add-check-to-validate-current-entry-value.patch CVE-2016-1714-qemut-fw_cfg-add-check-to-validate-current-entry-value.patch - bsc#961358 - VUL-0: CVE-2015-8613: xen: qemu: scsi: stack based buffer overflow in megasas_ctrl_get_info OBS-URL: https://build.opensuse.org/package/show/Virtualization/xen?expand=0&rev=395
79 lines
2.4 KiB
Diff
79 lines
2.4 KiB
Diff
x86/mm: PV superpage handling lacks sanity checks
|
|
|
|
MMUEXT_{,UN}MARK_SUPER fail to check the input MFN for validity before
|
|
dereferencing pointers into the superpage frame table.
|
|
|
|
get_superpage() has a similar issue.
|
|
|
|
This is XSA-167.
|
|
|
|
Signed-off-by: Jan Beulich <jbeulich@suse.com>
|
|
Acked-by: Ian Campbell <ian.campbell@citrix.com>
|
|
|
|
Index: xen-4.6.0-testing/xen/arch/x86/mm.c
|
|
===================================================================
|
|
--- xen-4.6.0-testing.orig/xen/arch/x86/mm.c
|
|
+++ xen-4.6.0-testing/xen/arch/x86/mm.c
|
|
@@ -2624,6 +2624,9 @@ int get_superpage(unsigned long mfn, str
|
|
|
|
ASSERT(opt_allow_superpage);
|
|
|
|
+ if ( !mfn_valid(mfn | (L1_PAGETABLE_ENTRIES - 1)) )
|
|
+ return -EINVAL;
|
|
+
|
|
spage = mfn_to_spage(mfn);
|
|
y = spage->type_info;
|
|
do {
|
|
@@ -3401,42 +3404,26 @@ long do_mmuext_op(
|
|
}
|
|
|
|
case MMUEXT_MARK_SUPER:
|
|
+ case MMUEXT_UNMARK_SUPER:
|
|
{
|
|
unsigned long mfn = op.arg1.mfn;
|
|
|
|
- if ( unlikely(d != pg_owner) )
|
|
- rc = -EPERM;
|
|
- else if ( mfn & (L1_PAGETABLE_ENTRIES-1) )
|
|
- {
|
|
- MEM_LOG("Unaligned superpage reference mfn %lx", mfn);
|
|
- okay = 0;
|
|
- }
|
|
- else if ( !opt_allow_superpage )
|
|
+ if ( !opt_allow_superpage )
|
|
{
|
|
MEM_LOG("Superpages disallowed");
|
|
rc = -ENOSYS;
|
|
}
|
|
- else
|
|
- rc = mark_superpage(mfn_to_spage(mfn), d);
|
|
- break;
|
|
- }
|
|
-
|
|
- case MMUEXT_UNMARK_SUPER:
|
|
- {
|
|
- unsigned long mfn = op.arg1.mfn;
|
|
-
|
|
- if ( unlikely(d != pg_owner) )
|
|
+ else if ( unlikely(d != pg_owner) )
|
|
rc = -EPERM;
|
|
- else if ( mfn & (L1_PAGETABLE_ENTRIES-1) )
|
|
+ else if ( mfn & (L1_PAGETABLE_ENTRIES - 1) )
|
|
{
|
|
MEM_LOG("Unaligned superpage reference mfn %lx", mfn);
|
|
- okay = 0;
|
|
- }
|
|
- else if ( !opt_allow_superpage )
|
|
- {
|
|
- MEM_LOG("Superpages disallowed");
|
|
- rc = -ENOSYS;
|
|
+ rc = -EINVAL;
|
|
}
|
|
+ else if ( !mfn_valid(mfn | (L1_PAGETABLE_ENTRIES - 1)) )
|
|
+ rc = -EINVAL;
|
|
+ else if ( op.cmd == MMUEXT_MARK_SUPER )
|
|
+ rc = mark_superpage(mfn_to_spage(mfn), d);
|
|
else
|
|
rc = unmark_superpage(mfn_to_spage(mfn));
|
|
break;
|