From 2f56b032bc31fa663a104dd2bc51a1a4cbc6595d Mon Sep 17 00:00:00 2001 From: Jan Beulich Date: Thu, 11 Jun 2015 15:02:01 +0200 Subject: [PATCH] gnttab: add missing version check to GNTTABOP_swap_grant_ref handling ... avoiding NULL derefs when the version to use wasn't set yet (via GNTTABOP_setup_table or GNTTABOP_set_version). This is CVE-2015-4163 / XSA-134. Signed-off-by: Jan Beulich Acked-by: Ian Campbell master commit: 5d5c09d853d3f212861f70c577c65d1703f752ae master date: 2015-06-11 14:44:12 +0200 --- xen/common/grant_table.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/xen/common/grant_table.c b/xen/common/grant_table.c index 9182a44fbb..fd25728041 100644 --- a/xen/common/grant_table.c +++ b/xen/common/grant_table.c @@ -2394,6 +2394,9 @@ __gnttab_swap_grant_ref(grant_ref_t ref_a, grant_ref_t ref_b) spin_lock(>->lock); + if ( gt->gt_version == 0 ) + PIN_FAIL(out, GNTST_general_error, "grant table not yet set up\n"); + /* Bounds check on the grant refs */ if ( unlikely(ref_a >= nr_grant_entries(d->grant_table))) PIN_FAIL(out, GNTST_bad_gntref, "Bad ref-a (%d).\n", ref_a); -- 2.39.5