Commit 13e7303b authored by Natanael Copa's avatar Natanael Copa
Browse files

main/xen: security fix (CVE-2013-2072)

ref #1900
fixes #1903
parent dd895219
......@@ -3,7 +3,7 @@
# Maintainer: William Pitcock <nenolod@dereferenced.org>
pkgname=xen
pkgver=4.1.4
pkgrel=2
pkgrel=3
pkgdesc="Xen hypervisor"
url="http://www.xen.org/"
arch="x86 x86_64"
......@@ -24,6 +24,7 @@ source="http://bits.xensource.com/oss-xen/release/$pkgver/$pkgname-$pkgver.tar.g
busybox-sed.patch
xsa33-4.1.patch
xsa41.patch
xsa56.patch
xenstored.initd
xenstored.confd
......@@ -125,6 +126,7 @@ fa06495a175571f4aa3b6cb88937953e librt.patch
1bea3543ddc712330527b62fd9ff6520 busybox-sed.patch
25ba4efc5eee29daa12855fbadce84f8 xsa33-4.1.patch
ce56f00762139cd611dfc3332b7571cf xsa41.patch
e70b9128ffc2175cea314a533a7d8457 xsa56.patch
6e5739dad7e2bd1b625e55ddc6c782b7 xenstored.initd
b017ccdd5e1c27bbf1513e3569d4ff07 xenstored.confd
ed262f15fb880badb53575539468646c xenconsoled.initd
......
libxc: limit cpu values when setting vcpu affinity
When support for pinning more than 64 cpus was added, check for cpu
out-of-range values was removed. This can lead to subsequent
out-of-bounds cpumap array accesses in case the cpu number is higher
than the actual count.
This patch returns the check.
This is CVE-2013-2072 / XSA-56
Signed-off-by: Petr Matousek <pmatouse@redhat.com>
diff --git a/tools/python/xen/lowlevel/xc/xc.c b/tools/python/xen/lowlevel/xc/xc.c
index e220f68..e611b24 100644
--- a/tools/python/xen/lowlevel/xc/xc.c
+++ b/tools/python/xen/lowlevel/xc/xc.c
@@ -228,6 +228,7 @@ static PyObject *pyxc_vcpu_setaffinity(XcObject *self,
int vcpu = 0, i;
xc_cpumap_t cpumap;
PyObject *cpulist = NULL;
+ int nr_cpus;
static char *kwd_list[] = { "domid", "vcpu", "cpumap", NULL };
@@ -235,6 +236,10 @@ static PyObject *pyxc_vcpu_setaffinity(XcObject *self,
&dom, &vcpu, &cpulist) )
return NULL;
+ nr_cpus = xc_get_max_cpus(self->xc_handle);
+ if ( nr_cpus == 0 )
+ return pyxc_error_to_exception(self->xc_handle);
+
cpumap = xc_cpumap_alloc(self->xc_handle);
if(cpumap == NULL)
return pyxc_error_to_exception(self->xc_handle);
@@ -244,6 +249,13 @@ static PyObject *pyxc_vcpu_setaffinity(XcObject *self,
for ( i = 0; i < PyList_Size(cpulist); i++ )
{
long cpu = PyInt_AsLong(PyList_GetItem(cpulist, i));
+ if ( cpu < 0 || cpu >= nr_cpus )
+ {
+ free(cpumap);
+ errno = EINVAL;
+ PyErr_SetFromErrno(xc_error_obj);
+ return NULL;
+ }
cpumap[cpu / 8] |= 1 << (cpu % 8);
}
}
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment