[Pkg-xen-changes] [xen] 01/08: x86/HVM: prevent use-after-free when destroying a domain

[Bastian Blank]

This is an automated email from the git hooks/post-receive script.

waldi pushed a commit to branch debian/jessie
in repository xen.

commit 0a9a4ac4b9d143e8d633c65e3c680e14d03b00e2
Author: Mihai Donțu <mdontu at bitdefender.com>
Date:   Tue Jan 6 12:49:52 2015 +0000

    x86/HVM: prevent use-after-free when destroying a domain
    
    hvm_domain_relinquish_resources() can free certain domain resources
    which can still be accessed, e.g. by HVMOP_set_param, while the domain
    is being cleaned up.
    
    This is CVE-2015-0361 / XSA-116.
    
    Signed-off-by: Mihai Donțu <mdontu at bitdefender.com>
    Tested-by: Răzvan Cojocaru <rcojocaru at bitdefender.com>
    Reviewed-by: Andrew Cooper <andrew.cooper3 at citrix.com>
    Reviewed-by: Jan Beulich <jbeulich at suse.com>
    (cherry picked from commit d3c151fd3a4365fc6107198bfc975807d40d157d)
    (cherry picked from commit 089dd62211042011e26de1b87b558394cdfe388b)
    
    Patch-Name: CVE-2015-0361.diff
---
 xen/arch/x86/hvm/hvm.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/xen/arch/x86/hvm/hvm.c b/xen/arch/x86/hvm/hvm.c
index 0c04972..57c5e34 100644
--- a/xen/arch/x86/hvm/hvm.c
+++ b/xen/arch/x86/hvm/hvm.c
@@ -625,9 +625,6 @@ int hvm_domain_initialise(struct domain *d)
 
 void hvm_domain_relinquish_resources(struct domain *d)
 {
-    xfree(d->arch.hvm_domain.io_handler);
-    xfree(d->arch.hvm_domain.params);
-
     if ( is_pvh_domain(d) )
         return;
 
@@ -650,6 +647,9 @@ void hvm_domain_relinquish_resources(struct domain *d)
 
 void hvm_domain_destroy(struct domain *d)
 {
+    xfree(d->arch.hvm_domain.io_handler);
+    xfree(d->arch.hvm_domain.params);
+
     hvm_destroy_cacheattr_region_list(d);
 
     if ( is_pvh_domain(d) )

-- 
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/pkg-xen/xen.git