aboutsummaryrefslogtreecommitdiffstats
path: root/main/xen/xsa35-4.2-with-xsa34.patch
blob: 89230e2a464a22b3d1646c0808e404a7809bc656 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
xen: Do not allow guests to enable nested HVM on themselves

There is no reason for this and doing so exposes a memory leak to
guests. Only toolstacks need write access to this HVM param.

This is XSA-35 / CVE-2013-0152.

Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
Acked-by: Jan Beulich <JBeulich@suse.com>

--- a/xen/arch/x86/hvm/hvm.c
+++ b/xen/arch/x86/hvm/hvm.c
@@ -3862,6 +3862,11 @@ long do_hvm_op(unsigned long op, XEN_GUEST_HANDLE(void) arg)
                     rc = -EINVAL;
                 break;
             case HVM_PARAM_NESTEDHVM:
+                if ( !IS_PRIV(current->domain) )
+                {
+                    rc = -EPERM;
+                    break;
+                }
 #ifdef __i386__
                 if ( a.value )
                     rc = -EINVAL;