mirror of
https://github.com/xen-project/xen.git
synced 2026-10-29 10:40:03 +01:00
Edwin Török
491a077ed4
c/sf8c72b5261"oxenstored: implement XS_RESET_WATCHES" from Xen 4.6 introduced reset watches support in oxenstored by mirroring the change in cxenstored. However the OCaml version has some additional data structures to optimize watch firing, and just resetting the watches in one of the data structures creates a security bug where a malicious guest kernel can exceed its watch quota, driving oxenstored into OOM: * create watches * reset watches (this still keeps the watches lingering in another data structure, using memory) * create some more watches * loop until oxenstored dies The guest kernel doesn't necessarily have to be malicious to trigger this: * if control/platform-feature-xs_reset_watches is set * the guest kexecs (e.g. because it crashes) * on boot more watches are set up * this will slowly "leak" memory for watches in oxenstored, driving it towards OOM. This is XSA-330. Fixes:f8c72b5261("oxenstored: implement XS_RESET_WATCHES") Signed-off-by: Edwin Török <edvin.torok@citrix.com> Acked-by: Christian Lindig <christian.lindig@citrix.com> Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>