libelf: fix stack memory leak when loading 32 bit symbol tables
authorRoger Pau Monné <roger.pau@citrix.com>
Tue, 22 Nov 2016 12:48:30 +0000 (13:48 +0100)
committerJan Beulich <jbeulich@suse.com>
Tue, 22 Nov 2016 12:48:30 +0000 (13:48 +0100)
commitfb08f7d009a64b96efa4462c9d19ed6881936859
tree16c4d06e95241aee555fb2494a6861faa39f4b44
parentf3fa3abf3e61fb1f25ce721e14ac324dda67311f
libelf: fix stack memory leak when loading 32 bit symbol tables

The 32 bit Elf structs are smaller than the 64 bit ones, which means that
when loading them there's some padding left uninitialized at the end of each
struct (because the size indicated in e_ehsize and e_shentsize is
smaller than the size of elf_ehdr and elf_shdr).

Fix this by introducing a new helper that is used to set
[caller_]xdest_{base/size} and that takes care of performing the appropriate
memset of the region. This newly introduced helper is then used to set and
unset xdest_{base/size} in elf_load_bsdsyms. Now that the full struct
is zeroed, there's no need to specifically zero the undefined section.

This is CVE-2016-9384 / XSA-164.

Suggested-by: Ian Jackson <ian.jackson@eu.citrix.com>
Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
Also remove the open coded (and redundant with the earlier
elf_memset_unchecked()) use of caller_xdest_* from elf_init().

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Signed-off-by: Ian Jackson <Ian.Jackson@eu.citrix.com>
xen/common/libelf/libelf-loader.c
xen/common/libelf/libelf-tools.c
xen/include/xen/libelf.h