|
 |
d6234ae |
pre-fill structures for certain HYPERVISOR_xen_version sub-ops
|
|
|
d6234ae |
|
|
|
d6234ae |
... avoiding to pass hypervisor stack contents back to the caller
|
|
|
d6234ae |
through space unused by the respective strings.
|
|
|
d6234ae |
|
|
|
d6234ae |
This is CVE-2015-2045 / XSA-122.
|
|
|
d6234ae |
|
|
|
d6234ae |
Signed-off-by: Aaron Adams <Aaron.Adams@nccgroup.com>
|
|
|
d6234ae |
Acked-by: Jan Beulich <jbeulich@suse.com>
|
|
|
d6234ae |
Acked-by: Ian Campbell <ian.campbell@citrix.com>
|
|
|
d6234ae |
|
|
|
d6234ae |
--- a/xen/common/kernel.c
|
|
|
d6234ae |
+++ b/xen/common/kernel.c
|
|
|
d6234ae |
@@ -240,6 +240,8 @@ DO(xen_version)(int cmd, XEN_GUEST_HANDL
|
|
|
d6234ae |
case XENVER_extraversion:
|
|
|
d6234ae |
{
|
|
|
d6234ae |
xen_extraversion_t extraversion;
|
|
|
d6234ae |
+
|
|
|
d6234ae |
+ memset(extraversion, 0, sizeof(extraversion));
|
|
|
d6234ae |
safe_strcpy(extraversion, xen_extra_version());
|
|
|
d6234ae |
if ( copy_to_guest(arg, extraversion, ARRAY_SIZE(extraversion)) )
|
|
|
d6234ae |
return -EFAULT;
|
|
|
d6234ae |
@@ -249,6 +251,8 @@ DO(xen_version)(int cmd, XEN_GUEST_HANDL
|
|
|
d6234ae |
case XENVER_compile_info:
|
|
|
d6234ae |
{
|
|
|
d6234ae |
struct xen_compile_info info;
|
|
|
d6234ae |
+
|
|
|
d6234ae |
+ memset(&info, 0, sizeof(info));
|
|
|
d6234ae |
safe_strcpy(info.compiler, xen_compiler());
|
|
|
d6234ae |
safe_strcpy(info.compile_by, xen_compile_by());
|
|
|
d6234ae |
safe_strcpy(info.compile_domain, xen_compile_domain());
|
|
|
d6234ae |
@@ -284,6 +288,8 @@ DO(xen_version)(int cmd, XEN_GUEST_HANDL
|
|
|
d6234ae |
case XENVER_changeset:
|
|
|
d6234ae |
{
|
|
|
d6234ae |
xen_changeset_info_t chgset;
|
|
|
d6234ae |
+
|
|
|
d6234ae |
+ memset(chgset, 0, sizeof(chgset));
|
|
|
d6234ae |
safe_strcpy(chgset, xen_changeset());
|
|
|
d6234ae |
if ( copy_to_guest(arg, chgset, ARRAY_SIZE(chgset)) )
|
|
|
d6234ae |
return -EFAULT;
|