diff --git a/xen.spec b/xen.spec index 78897e5..d8a8ffd 100644 --- a/xen.spec +++ b/xen.spec @@ -41,7 +41,7 @@ Summary: Xen is a virtual machine monitor Name: xen Version: 4.8.0 -Release: 5%{?dist} +Release: 6%{?dist} Group: Development/Libraries License: GPLv2+ and LGPLv2+ and BSD URL: http://xen.org/ @@ -117,7 +117,10 @@ Patch57: xsa208-qemuu.patch Patch58: xen.gcc7.fix.patch Patch59: xsa207.patch Patch60: xsa209-qemut.patch -Patch61: xsa209-qemuu.patch +Patch61: xsa209-qemuu-0001-display-cirrus-ignore-source-pitch-value-as-needed-i.patch +Patch62: xsa209-qemuu-0002-cirrus-add-blit_is_unsafe-call-to-cirrus_bitblt_cput.patch +Patch63: xsa210.patch + BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root BuildRequires: transfig libidn-devel zlib-devel texi2html SDL-devel curl-devel @@ -322,6 +325,7 @@ manage Xen virtual machines. %patch51 -p1 %patch58 -p1 %patch59 -p1 +%patch63 -p1 # qemu-xen-traditional patches pushd tools/qemu-xen-traditional @@ -859,6 +863,10 @@ rm -rf %{buildroot} %endif %changelog +* Sat Feb 25 2017 Michael Young - 4.8.0-6 +- update patches for XSA-209 +- arm: memory corruption when freeing p2m pages [XSA-210] (#1426327) + * Wed Feb 22 2017 Michael Young - 4.8.0-5 - cirrus_bitblt_cputovideo does not check if memory region is safe [XSA-209, CVE-2017-2620] (#1425420) diff --git a/xsa209-qemuu-0001-display-cirrus-ignore-source-pitch-value-as-needed-i.patch b/xsa209-qemuu-0001-display-cirrus-ignore-source-pitch-value-as-needed-i.patch new file mode 100644 index 0000000..21e44ad --- /dev/null +++ b/xsa209-qemuu-0001-display-cirrus-ignore-source-pitch-value-as-needed-i.patch @@ -0,0 +1,72 @@ +From 52b7f43c8fa185ab856bcaacda7abc9a6fc07f84 Mon Sep 17 00:00:00 2001 +From: Bruce Rogers +Date: Tue, 21 Feb 2017 10:54:38 -0800 +Subject: [PATCH 1/2] display: cirrus: ignore source pitch value as needed in + blit_is_unsafe + +Commit 4299b90 added a check which is too broad, given that the source +pitch value is not required to be initialized for solid fill operations. +This patch refines the blit_is_unsafe() check to ignore source pitch in +that case. After applying the above commit as a security patch, we +noticed the SLES 11 SP4 guest gui failed to initialize properly. + +Signed-off-by: Bruce Rogers +Message-id: 20170109203520.5619-1-brogers@suse.com +Signed-off-by: Gerd Hoffmann +--- + hw/display/cirrus_vga.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +diff --git a/hw/display/cirrus_vga.c b/hw/display/cirrus_vga.c +index 7bf3707..34a6900 100644 +--- a/hw/display/cirrus_vga.c ++++ b/hw/display/cirrus_vga.c +@@ -288,7 +288,7 @@ static bool blit_region_is_unsafe(struct CirrusVGAState *s, + return false; + } + +-static bool blit_is_unsafe(struct CirrusVGAState *s) ++static bool blit_is_unsafe(struct CirrusVGAState *s, bool dst_only) + { + /* should be the case, see cirrus_bitblt_start */ + assert(s->cirrus_blt_width > 0); +@@ -302,6 +302,9 @@ static bool blit_is_unsafe(struct CirrusVGAState *s) + s->cirrus_blt_dstaddr & s->cirrus_addr_mask)) { + return true; + } ++ if (dst_only) { ++ return false; ++ } + if (blit_region_is_unsafe(s, s->cirrus_blt_srcpitch, + s->cirrus_blt_srcaddr & s->cirrus_addr_mask)) { + return true; +@@ -667,7 +670,7 @@ static int cirrus_bitblt_common_patterncopy(CirrusVGAState * s, + + dst = s->vga.vram_ptr + (s->cirrus_blt_dstaddr & s->cirrus_addr_mask); + +- if (blit_is_unsafe(s)) ++ if (blit_is_unsafe(s, false)) + return 0; + + (*s->cirrus_rop) (s, dst, src, +@@ -685,7 +688,7 @@ static int cirrus_bitblt_solidfill(CirrusVGAState *s, int blt_rop) + { + cirrus_fill_t rop_func; + +- if (blit_is_unsafe(s)) { ++ if (blit_is_unsafe(s, true)) { + return 0; + } + rop_func = cirrus_fill[rop_to_index[blt_rop]][s->cirrus_blt_pixelwidth - 1]; +@@ -784,7 +787,7 @@ static void cirrus_do_copy(CirrusVGAState *s, int dst, int src, int w, int h) + + static int cirrus_bitblt_videotovideo_copy(CirrusVGAState * s) + { +- if (blit_is_unsafe(s)) ++ if (blit_is_unsafe(s, false)) + return 0; + + return cirrus_do_copy(s, s->cirrus_blt_dstaddr - s->vga.start_addr, +-- +2.1.4 + diff --git a/xsa209-qemuu-0002-cirrus-add-blit_is_unsafe-call-to-cirrus_bitblt_cput.patch b/xsa209-qemuu-0002-cirrus-add-blit_is_unsafe-call-to-cirrus_bitblt_cput.patch new file mode 100644 index 0000000..ed549f9 --- /dev/null +++ b/xsa209-qemuu-0002-cirrus-add-blit_is_unsafe-call-to-cirrus_bitblt_cput.patch @@ -0,0 +1,60 @@ +From 15268f91fbe75b38a851c458aef74e693d646ea5 Mon Sep 17 00:00:00 2001 +From: Gerd Hoffmann +Date: Tue, 21 Feb 2017 10:54:59 -0800 +Subject: [PATCH 2/2] cirrus: add blit_is_unsafe call to + cirrus_bitblt_cputovideo + +CIRRUS_BLTMODE_MEMSYSSRC blits do NOT check blit destination +and blit width, at all. Oops. Fix it. + +Security impact: high. + +The missing blit destination check allows to write to host memory. +Basically same as CVE-2014-8106 for the other blit variants. + +The missing blit width check allows to overflow cirrus_bltbuf, +with the attractive target cirrus_srcptr (current cirrus_bltbuf write +position) being located right after cirrus_bltbuf in CirrusVGAState. + +Due to cirrus emulation writing cirrus_bltbuf bytewise the attacker +hasn't full control over cirrus_srcptr though, only one byte can be +changed. Once the first byte has been modified further writes land +elsewhere. + +[ This is CVE-2017-2620 / XSA-209 - Ian Jackson ] + +Reported-by: Gerd Hoffmann +Signed-off-by: Gerd Hoffmann +--- + hw/display/cirrus_vga.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/hw/display/cirrus_vga.c b/hw/display/cirrus_vga.c +index 34a6900..5901250 100644 +--- a/hw/display/cirrus_vga.c ++++ b/hw/display/cirrus_vga.c +@@ -865,6 +865,10 @@ static int cirrus_bitblt_cputovideo(CirrusVGAState * s) + { + int w; + ++ if (blit_is_unsafe(s, true)) { ++ return 0; ++ } ++ + s->cirrus_blt_mode &= ~CIRRUS_BLTMODE_MEMSYSSRC; + s->cirrus_srcptr = &s->cirrus_bltbuf[0]; + s->cirrus_srcptr_end = &s->cirrus_bltbuf[0]; +@@ -890,6 +894,10 @@ static int cirrus_bitblt_cputovideo(CirrusVGAState * s) + } + s->cirrus_srccounter = s->cirrus_blt_srcpitch * s->cirrus_blt_height; + } ++ ++ /* the blit_is_unsafe call above should catch this */ ++ assert(s->cirrus_blt_srcpitch <= CIRRUS_BLTBUFSIZE); ++ + s->cirrus_srcptr = s->cirrus_bltbuf; + s->cirrus_srcptr_end = s->cirrus_bltbuf + s->cirrus_blt_srcpitch; + cirrus_update_memory_access(s); +-- +2.1.4 + diff --git a/xsa209-qemuu.patch b/xsa209-qemuu.patch deleted file mode 100644 index a052013..0000000 --- a/xsa209-qemuu.patch +++ /dev/null @@ -1,57 +0,0 @@ -From: Gerd Hoffmann -Subject: [PATCH 3/3] cirrus: add blit_is_unsafe call to cirrus_bitblt_cputovideo - -CIRRUS_BLTMODE_MEMSYSSRC blits do NOT check blit destination -and blit width, at all. Oops. Fix it. - -Security impact: high. - -The missing blit destination check allows to write to host memory. -Basically same as CVE-2014-8106 for the other blit variants. - -The missing blit width check allows to overflow cirrus_bltbuf, -with the attractive target cirrus_srcptr (current cirrus_bltbuf write -position) being located right after cirrus_bltbuf in CirrusVGAState. - -Due to cirrus emulation writing cirrus_bltbuf bytewise the attacker -hasn't full control over cirrus_srcptr though, only one byte can be -changed. Once the first byte has been modified further writes land -elsewhere. - -[ This is CVE-2017-2620 / XSA-209 - Ian Jackson ] - -Reported-by: Gerd Hoffmann -Signed-off-by: Gerd Hoffmann ---- - hw/display/cirrus_vga.c | 8 ++++++++ - 1 file changed, 8 insertions(+) - -diff --git a/hw/display/cirrus_vga.c b/hw/display/cirrus_vga.c -index 0e47cf8..a093dc8 100644 ---- a/hw/display/cirrus_vga.c -+++ b/hw/display/cirrus_vga.c -@@ -899,6 +899,10 @@ static int cirrus_bitblt_cputovideo(CirrusVGAState * s) - { - int w; - -+ if (blit_is_unsafe(s, true)) { -+ return 0; -+ } -+ - s->cirrus_blt_mode &= ~CIRRUS_BLTMODE_MEMSYSSRC; - s->cirrus_srcptr = &s->cirrus_bltbuf[0]; - s->cirrus_srcptr_end = &s->cirrus_bltbuf[0]; -@@ -924,6 +928,10 @@ static int cirrus_bitblt_cputovideo(CirrusVGAState * s) - } - s->cirrus_srccounter = s->cirrus_blt_srcpitch * s->cirrus_blt_height; - } -+ -+ /* the blit_is_unsafe call above should catch this */ -+ assert(s->cirrus_blt_srcpitch <= CIRRUS_BLTBUFSIZE); -+ - s->cirrus_srcptr = s->cirrus_bltbuf; - s->cirrus_srcptr_end = s->cirrus_bltbuf + s->cirrus_blt_srcpitch; - cirrus_update_memory_access(s); --- -1.8.3.1 - diff --git a/xsa210.patch b/xsa210.patch new file mode 100644 index 0000000..0696570 --- /dev/null +++ b/xsa210.patch @@ -0,0 +1,41 @@ +From: Julien Grall +Subject: arm/p2m: remove the page from p2m->pages list before freeing it + +The p2m code is using the page list field to link all the pages used +for the stage-2 page tables. The page is added into the p2m->pages +list just after the allocation but never removed from the list. + +The page list field is also used by the allocator, not removing may +result a later Xen crash due to inconsistency (see [1]). + +This bug was introduced by the reworking of p2m code in commit 2ef3e36ec7 +"xen/arm: p2m: Introduce p2m_set_entry and __p2m_set_entry". + +[1] https://lists.xenproject.org/archives/html/xen-devel/2017-02/msg00524.html + +Reported-by: Vijaya Kumar K +Signed-off-by: Julien Grall +Reviewed-by: Stefano Stabellini + +--- a/xen/arch/arm/p2m.c ++++ b/xen/arch/arm/p2m.c +@@ -660,6 +660,7 @@ static void p2m_free_entry(struct p2m_domain *p2m, + unsigned int i; + lpae_t *table; + mfn_t mfn; ++ struct page_info *pg; + + /* Nothing to do if the entry is invalid. */ + if ( !p2m_valid(entry) ) +@@ -697,7 +698,10 @@ static void p2m_free_entry(struct p2m_domain *p2m, + mfn = _mfn(entry.p2m.base); + ASSERT(mfn_valid(mfn_x(mfn))); + +- free_domheap_page(mfn_to_page(mfn_x(mfn))); ++ pg = mfn_to_page(mfn_x(mfn)); ++ ++ page_list_del(pg, &p2m->pages); ++ free_domheap_page(pg); + } + + static bool p2m_split_superpage(struct p2m_domain *p2m, lpae_t *entry,