From 3fc87c0c65f83cc613726b2c33942a19715f4289 Mon Sep 17 00:00:00 2001 From: Ian Campbell Date: Wed, 23 Jan 2013 11:47:24 +0100 Subject: [PATCH] xen: Do not allow guests to enable nested HVM on themselves There is no reason for this and doing so exposes a memory leak to guests. Only toolstacks need write access to this HVM param. This is XSA-35 / CVE-2013-0152. Signed-off-by: Ian Campbell Acked-by: Jan Beulich Committed-by: Jan Beulich --- xen/arch/x86/hvm/hvm.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/xen/arch/x86/hvm/hvm.c b/xen/arch/x86/hvm/hvm.c index b5535c0de9..d702de4e86 100644 --- a/xen/arch/x86/hvm/hvm.c +++ b/xen/arch/x86/hvm/hvm.c @@ -3881,6 +3881,11 @@ long do_hvm_op(unsigned long op, XEN_GUEST_HANDLE_PARAM(void) arg) rc = -EINVAL; break; case HVM_PARAM_NESTEDHVM: + if ( !IS_PRIV(current->domain) ) + { + rc = -EPERM; + break; + } if ( a.value > 1 ) rc = -EINVAL; if ( !is_hvm_domain(d) ) -- 2.30.2