OSDN Git Service

hw/xen: prevent guest from binding loopback event channel to itself
authorDavid Woodhouse <dwmw@amazon.co.uk>
Tue, 25 Jul 2023 10:05:00 +0000 (12:05 +0200)
committerPhilippe Mathieu-Daudé <philmd@linaro.org>
Tue, 1 Aug 2023 21:52:23 +0000 (23:52 +0200)
commit75a87af9b228ca7d14902a9390fe5e83c4898eb0
tree9c32705683936eb76605928a8b1e7121a3cf4605
parent19c417ec87a446ffd1a13eeec23226fe30f31b7e
hw/xen: prevent guest from binding loopback event channel to itself

Fuzzing showed that a guest could bind an interdomain port to itself, by
guessing the next port to be allocated and putting that as the 'remote'
port number. By chance, that works because the newly-allocated port has
type EVTCHNSTAT_unbound. It shouldn't.

Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Reviewed-by: Paul Durrant <paul@xen.org>
Message-Id: <20230801175747.145906-4-dwmw2@infradead.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
hw/i386/kvm/xen_evtchn.c