sm-commit AT lists.ibiblio.org

Subject: Source Mage code commit list

List archive

[SM-Commit] GIT changes to master grimoire by Vlad Glagolev (c00291a5bee6e4b5cc89a008f7cc34c9e3148f74)

From: Vlad Glagolev <scm AT sourcemage.org>
To: sm-commit AT lists.ibiblio.org
Subject: [SM-Commit] GIT changes to master grimoire by Vlad Glagolev (c00291a5bee6e4b5cc89a008f7cc34c9e3148f74)
Date: Thu, 6 Dec 2012 16:52:52 -0600

GIT changes to master grimoire by Vlad Glagolev <stealth AT sourcemage.org>:

utils/xen/DETAILS | 2
utils/xen/HISTORY | 8 ++-
utils/xen/PRE_BUILD | 5 ++
utils/xen/xsa-12.patch | 22 +++++++++
utils/xen/xsa-13.patch | 30 +++++++++++++
utils/xen/xsa-14.patch | 22 +++++++++
utils/xen/xsa-16.patch | 31 +++++++++++++
utils/xen/xsa-17.patch | 113
+++++++++++++++++++++++++++++++++++++++++++++++++
8 files changed, 229 insertions(+), 4 deletions(-)

New commits:
commit c00291a5bee6e4b5cc89a008f7cc34c9e3148f74
Author: Vlad Glagolev <stealth AT sourcemage.org>
Commit: Vlad Glagolev <stealth AT sourcemage.org>

xen: security update

diff --git a/utils/xen/DETAILS b/utils/xen/DETAILS
index e7dcf7c..8ce05b5 100755
--- a/utils/xen/DETAILS
+++ b/utils/xen/DETAILS
@@ -1,6 +1,6 @@
SPELL=xen
VERSION=4.1.3
- SECURITY_PATCH=4
+ SECURITY_PATCH=5
SOURCE=${SPELL}-${VERSION}.tar.gz
SOURCE2=$SOURCE.sig
SOURCE2_IGNORE=signature
diff --git a/utils/xen/HISTORY b/utils/xen/HISTORY
index e11e93d..6d6300b 100644
--- a/utils/xen/HISTORY
+++ b/utils/xen/HISTORY
@@ -1,8 +1,10 @@
2012-12-07 Vlad Glagolev <stealth AT sourcemage.org>
- * DETAILS: SECURITY_PATCH++
+ * DETAILS: SECURITY_PATCH+=2
* PRE_BUILD: apply patches
- * xsa-{26-31}.patch: added, to fix CVE-2012-5510, CVE-2012-5511,
- CVE-2012-5512, CVE-2012-5513, CVE-2012-5514, CVE-2012-5515
+ * xsa-{12-14,16-17,26-31}.patch: added, to fix CVE-2012-3494,
+ CVE-2012-3495, CVE-2012-3496, CVE-2012-3498, CVE-2012-3515,
+ CVE-2012-5510, CVE-2012-5511, CVE-2012-5512, CVE-2012-5513,
+ CVE-2012-5514, CVE-2012-5515

2012-11-17 Vlad Glagolev <stealth AT sourcemage.org>
* DETAILS: SECURITY_PATCH++
diff --git a/utils/xen/PRE_BUILD b/utils/xen/PRE_BUILD
index 25ecad0..c738dc4 100755
--- a/utils/xen/PRE_BUILD
+++ b/utils/xen/PRE_BUILD
@@ -1,6 +1,11 @@
default_pre_build &&
cd ${SOURCE_DIRECTORY} &&

+patch -p1 < "$SPELL_DIRECTORY/xsa-12.patch" &&
+patch -p1 < "$SPELL_DIRECTORY/xsa-13.patch" &&
+patch -p1 < "$SPELL_DIRECTORY/xsa-14.patch" &&
+patch -p1 < "$SPELL_DIRECTORY/xsa-16.patch" &&
+patch -p1 < "$SPELL_DIRECTORY/xsa-17.patch" &&
patch -p0 < "$SPELL_DIRECTORY/xsa-19.patch" &&
patch -p1 < "$SPELL_DIRECTORY/xsa-20.patch" &&
patch -p1 < "$SPELL_DIRECTORY/xsa-21.patch" &&
diff --git a/utils/xen/xsa-12.patch b/utils/xen/xsa-12.patch
new file mode 100644
index 0000000..271c4d8
--- /dev/null
+++ b/utils/xen/xsa-12.patch
@@ -0,0 +1,22 @@
+xen: prevent a 64 bit guest setting reserved bits in DR7
+
+The upper 32 bits of this register are reserved and should be written as
+zero.
+
+This is XSA-12 / CVE-2012-3494
+
+Signed-off-by: Jan Beulich <jbeulich AT suse.com>
+Reviewed-by: Ian Campbell <ian.campbell AT citrix.com>
+
+diff -r 353bc0801b11 xen/include/asm-x86/debugreg.h
+--- a/xen/include/asm-x86/debugreg.h Mon Aug 06 12:28:03 2012 +0100
++++ b/xen/include/asm-x86/debugreg.h Wed Aug 15 12:00:21 2012 +0100
+@@ -58,7 +58,7 @@
+ We can slow the instruction pipeline for instructions coming via the
+ gdt or the ldt if we want to. I am not sure why this is an advantage */
+
+-#define DR_CONTROL_RESERVED_ZERO (0x0000d800ul) /* Reserved, read as zero */
++#define DR_CONTROL_RESERVED_ZERO (~0xffff27fful) /* Reserved, read as zero
*/
+ #define DR_CONTROL_RESERVED_ONE (0x00000400ul) /* Reserved, read as one */
+ #define DR_LOCAL_EXACT_ENABLE (0x00000100ul) /* Local exact enable */
+ #define DR_GLOBAL_EXACT_ENABLE (0x00000200ul) /* Global exact enable */
diff --git a/utils/xen/xsa-13.patch b/utils/xen/xsa-13.patch
new file mode 100644
index 0000000..35c4715
--- /dev/null
+++ b/utils/xen/xsa-13.patch
@@ -0,0 +1,30 @@
+xen: handle out-of-pirq condition correctly in PHYSDEVOP_get_free_pirq
+
+This is XSA-13 / CVE-2012-3495
+
+Signed-off-by: Ian Campbell <ian.campbell AT citrix.com>
+Signed-off-by: Jan Beulich <JBeulich AT suse.com>
+
+diff -r 1225aff05dd2 xen/arch/x86/physdev.c
+--- a/xen/arch/x86/physdev.c Thu Aug 09 16:48:07 2012 +0100
++++ b/xen/arch/x86/physdev.c Thu Aug 16 11:07:36 2012 +0100
+@@ -587,11 +587,16 @@ ret_t do_physdev_op(int cmd, XEN_GUEST_H
+ break;
+
+ spin_lock(&d->event_lock);
+- out.pirq = get_free_pirq(d, out.type, 0);
+- d->arch.pirq_irq[out.pirq] = PIRQ_ALLOCATED;
++ ret = get_free_pirq(d, out.type, 0);
++ if ( ret >= 0 )
++ d->arch.pirq_irq[ret] = PIRQ_ALLOCATED;
+ spin_unlock(&d->event_lock);
+
+- ret = copy_to_guest(arg, &out, 1) ? -EFAULT : 0;
++ if ( ret >= 0 )
++ {
++ out.pirq = ret;
++ ret = copy_to_guest(arg, &out, 1) ? -EFAULT : 0;
++ }
+
+ rcu_unlock_domain(d);
+ break;
diff --git a/utils/xen/xsa-14.patch b/utils/xen/xsa-14.patch
new file mode 100644
index 0000000..cd185b3
--- /dev/null
+++ b/utils/xen/xsa-14.patch
@@ -0,0 +1,22 @@
+xen: Don't BUG_ON() PoD operations on a non-translated guest.
+
+This is XSA-14 / CVE-2012-3496
+
+Signed-off-by: Tim Deegan <tim AT xen.org>
+Reviewed-by: Ian Campbell <ian.campbell AT citrix.com>
+Tested-by: Ian Campbell <ian.campbell AT citrix.com>
+
+diff -r 6779ddca8593 -r 8ebda5388e4e xen/arch/x86/mm/p2m.c
+--- a/xen/arch/x86/mm/p2m.c Wed Sep 05 12:28:17 2012 +0100
++++ b/xen/arch/x86/mm/p2m.c Wed Sep 05 12:29:05 2012 +0100
+@@ -2414,7 +2414,8 @@ guest_physmap_mark_populate_on_demand(st
+ int pod_count = 0;
+ int rc = 0;
+
+- BUG_ON(!paging_mode_translate(d));
++ if ( !paging_mode_translate(d) )
++ return -EINVAL;
+
+ rc = gfn_check_limit(d, gfn, order);
+ if ( rc != 0 )
+
diff --git a/utils/xen/xsa-16.patch b/utils/xen/xsa-16.patch
new file mode 100644
index 0000000..d9662d8
--- /dev/null
+++ b/utils/xen/xsa-16.patch
@@ -0,0 +1,31 @@
+x86/pvhvm: properly range-check PHYSDEVOP_map_pirq/MAP_PIRQ_TYPE_GSI
+
+This is being used as a array index, and hence must be validated before
+use.
+
+This is XSA-16 / CVE-2012-3498.
+
+Signed-off-by: Jan Beulich <jbeulich AT suse.com>
+
+diff -r 1225aff05dd2 xen/arch/x86/physdev.c
+--- a/xen/arch/x86/physdev.c Thu Aug 09 16:48:07 2012 +0100
++++ b/xen/arch/x86/physdev.c Thu Aug 16 13:03:36 2012 +0100
+@@ -40,11 +40,18 @@ static int physdev_hvm_map_pirq(
+ struct hvm_girq_dpci_mapping *girq;
+ uint32_t machine_gsi = 0;
+
++ if ( map->index < 0 || map->index >= NR_HVM_IRQS )
++ {
++ ret = -EINVAL;
++ break;
++ }
++
+ /* find the machine gsi corresponding to the
+ * emulated gsi */
+ hvm_irq_dpci = domain_get_irq_dpci(d);
+ if ( hvm_irq_dpci )
+ {
++ BUILD_BUG_ON(ARRAY_SIZE(hvm_irq_dpci->girq) < NR_HVM_IRQS);
+ list_for_each_entry ( girq,
+ &hvm_irq_dpci->girq[map->index],
+ list )
diff --git a/utils/xen/xsa-17.patch b/utils/xen/xsa-17.patch
new file mode 100644
index 0000000..9aa28e0
--- /dev/null
+++ b/utils/xen/xsa-17.patch
@@ -0,0 +1,113 @@
+console: bounds check whenever changing the cursor due to an escape code
+
+This is XSA-17 / CVE-2012-3515
+
+Signed-off-by: Ian Campbell <ian.campbell AT citrix.com>
+
+diff --git a/console.c b/console.c
+index 5e6e3d0..9984d6f 100644
+--- a/tools/ioemu-qemu-xen/console.c
++++ b/tools/ioemu-qemu-xen/console.c
+@@ -794,6 +794,26 @@ static void console_clear_xy(TextConsole *s, int x, int
y)
+ update_xy(s, x, y);
+ }
+
++/* set cursor, checking bounds */
++static void set_cursor(TextConsole *s, int x, int y)
++{
++ if (x < 0) {
++ x = 0;
++ }
++ if (y < 0) {
++ y = 0;
++ }
++ if (y >= s->height) {
++ y = s->height - 1;
++ }
++ if (x >= s->width) {
++ x = s->width - 1;
++ }
++
++ s->x = x;
++ s->y = y;
++}
++
+ static void console_putchar(TextConsole *s, int ch)
+ {
+ TextCell *c;
+@@ -869,7 +889,8 @@ static void console_putchar(TextConsole *s, int ch)
+ s->esc_params[s->nb_esc_params] * 10 + ch - '0';
+ }
+ } else {
+- s->nb_esc_params++;
++ if (s->nb_esc_params < MAX_ESC_PARAMS)
++ s->nb_esc_params++;
+ if (ch == ';')
+ break;
+ #ifdef DEBUG_CONSOLE
+@@ -883,59 +904,37 @@ static void console_putchar(TextConsole *s, int ch)
+ if (s->esc_params[0] == 0) {
+ s->esc_params[0] = 1;
+ }
+- s->y -= s->esc_params[0];
+- if (s->y < 0) {
+- s->y = 0;
+- }
++ set_cursor(s, s->x, s->y - s->esc_params[0]);
+ break;
+ case 'B':
+ /* move cursor down */
+ if (s->esc_params[0] == 0) {
+ s->esc_params[0] = 1;
+ }
+- s->y += s->esc_params[0];
+- if (s->y >= s->height) {
+- s->y = s->height - 1;
+- }
++ set_cursor(s, s->x, s->y + s->esc_params[0]);
+ break;
+ case 'C':
+ /* move cursor right */
+ if (s->esc_params[0] == 0) {
+ s->esc_params[0] = 1;
+ }
+- s->x += s->esc_params[0];
+- if (s->x >= s->width) {
+- s->x = s->width - 1;
+- }
++ set_cursor(s, s->x + s->esc_params[0], s->y);
+ break;
+ case 'D':
+ /* move cursor left */
+ if (s->esc_params[0] == 0) {
+ s->esc_params[0] = 1;
+ }
+- s->x -= s->esc_params[0];
+- if (s->x < 0) {
+- s->x = 0;
+- }
++ set_cursor(s, s->x - s->esc_params[0], s->y);
+ break;
+ case 'G':
+ /* move cursor to column */
+- s->x = s->esc_params[0] - 1;
+- if (s->x < 0) {
+- s->x = 0;
+- }
++ set_cursor(s, s->esc_params[0] - 1, s->y);
+ break;
+ case 'f':
+ case 'H':
+ /* move cursor to row, column */
+- s->x = s->esc_params[1] - 1;
+- if (s->x < 0) {
+- s->x = 0;
+- }
+- s->y = s->esc_params[0] - 1;
+- if (s->y < 0) {
+- s->y = 0;
+- }
++ set_cursor(s, s->esc_params[1] - 1, s->esc_params[0] - 1);
+ break;
+ case 'J':
+ switch (s->esc_params[0]) {

[SM-Commit] GIT changes to master grimoire by Vlad Glagolev (c00291a5bee6e4b5cc89a008f7cc34c9e3148f74), Vlad Glagolev, 12/06/2012