Edwin Török 0cd209a7e3 tools/ocaml/xenstored: Fix quota bypass on domain shutdown ...

XSA-322 fixed a domid reuse vulnerability by assigning Dom0 as the owner of
any nodes left after a domain is shutdown (e.g. outside its /local/domain/N
tree).

However Dom0 has no quota on purpose, so this opened up another potential
attack vector. Avoid it by deleting these nodes instead of assigning them to
Dom0.

This is part of XSA-419 / CVE-2022-42323.

Fixes: c46eff9212 ("tools/ocaml/xenstored: clean up permissions for dead domains")
Signed-off-by: Edwin Török <edvin.torok@citrix.com>
Acked-by: Christian Lindig <christian.lindig@citrix.com>
(cherry picked from commit db471408ed)

2022-11-01 15:20:41 +00:00

..

console

tools: Fix local variable block

2019-11-12 10:39:01 +00:00

debugger

kdd: fix build again

2020-07-06 08:38:03 +00:00

examples

xl.conf: introduce 'domid_policy'

2020-02-24 17:17:35 +00:00

firmware

tools/firmware: do not add a .note.gnu.property section

2022-04-07 09:11:53 +02:00

flask

xen: remove XEN_SYSCTL_set_parameter support

2020-05-29 12:20:31 +02:00

fuzz

x86emul: fix test harness and fuzzer build dependencies

2019-09-10 16:35:09 +02:00

golang

golang/xenlight: fix code generation for python 2.6

2021-06-17 19:45:39 +01:00

helpers

tools/xenstore: make the internal memory data base the default

2022-11-01 15:20:41 +00:00

hotplug

scripts: don't rely on "stat -" support

2020-06-26 10:08:05 +00:00

include

tools/xenstore: limit max number of nodes accessed in a transaction

2022-11-01 15:20:41 +00:00

libacpi

tools/libacpi: Use 64-byte alignment for FACS

2021-10-15 11:16:09 +02:00

libfsimage

libfsimage: fix parentheses in macro parameters

2020-03-13 10:20:26 +00:00

libs

libs/foreignmemory: Fix osdep_xenforeignmemory_map prototype

2021-07-15 09:31:12 +02:00

libvchan

vchan-socket-proxy: Handle closing shared input/output_fd

2020-06-26 12:00:05 +00:00

libxc

x86/cpuid: support LFENCE always serialising CPUID bit

2022-02-04 16:29:40 +00:00

libxl

libxl/Arm: correct xc_shadow_control() invocation to fix build

2022-10-12 17:36:03 +02:00

misc

x86/cpuid: Enumeration for BTC_NO

2022-07-12 16:31:49 +01:00

ocaml

tools/ocaml/xenstored: Fix quota bypass on domain shutdown

2022-11-01 15:20:41 +00:00

pygrub

tools/pygrub: Failing to set value to 0 in Grub2ConfigFile

2019-08-14 12:15:17 +01:00

python

tools/python: fix Python3.4 TypeError in format string

2021-07-15 11:59:32 +01:00

tests

x86: make hypervisor build with gcc11

2021-06-04 14:56:19 +02:00

xcutils

DEPS handling: Use DEPS_INCLUDE everywhere

2017-09-07 16:21:54 +01:00

xenbackendd

DEPS handling: Use DEPS_INCLUDE everywhere

2017-09-07 16:21:54 +01:00

xenmon

tools: Use INSTALL_PYTHON_PROG

2020-05-19 11:40:53 +01:00

xenpaging

DEPS handling: Use DEPS_INCLUDE everywhere

2017-09-07 16:21:54 +01:00

xenpmd

tools/xenpmd: Fix gcc10 snprintf warning

2020-11-09 17:14:23 +00:00

xenstat

tools/libxenstat: fix populating vbd.rd_sect

2021-07-15 11:59:32 +01:00

xenstore

tools/xenstore: make the internal memory data base the default

2022-11-01 15:20:41 +00:00

xentrace

credit2: fix credit reset happening too few times

2020-04-03 10:46:53 +02:00

xl

xl: Fix global pci options

2022-04-07 09:10:15 +02:00

config.h.in

libxl: use vchan for QMP access with Linux stubdomain

2020-05-19 16:19:15 +01:00

configure

tools: Commit autoconf output from Debian buster

2020-06-19 16:19:59 +01:00

configure.ac

tools: check go compiler version if present

2020-06-15 15:49:13 +01:00

cross-install

cross-install: Only apply in tools directory, and automatically wrap $INSTALL.

2008-08-30 08:36:02 +01:00

Makefile

Remove undocumented and unmaintained tools/memshr library

2020-01-15 15:22:28 +00:00

Rules.mk

Branch 4.14: Turn off debug on this stable branch

2020-07-13 14:57:37 +01:00