mirror of
https://github.com/xen-project/xen.git
synced 2026-10-28 02:01:24 +01:00
Edwin Török
ae34df4d82
Integers in Ocaml have 63 or 31 bits of signed precision. On 64-bit builds of Ocaml, this is fine because a C uint32_t always fits within a 63-bit signed integer. In 32-bit builds of Ocaml, this goes wrong. The C uint32_t is truncated first (loses the top bit), then has a unsigned/signed mismatch. A "negative" value (i.e. a packet on the ring of between 1G and 2G in size) will trigger an exception later in Bytes.make in xb.ml, and because the packet is not removed from the ring, the exception re-triggers on every subsequent query, creating a livelock. Fix both the source of the exception in Xb, and as defence in depth, mark the domain as bad for any Invalid_argument exceptions to avoid the risk of livelock. This is XSA-420 / CVE-2022-42324. Signed-off-by: Edwin Török <edvin.torok@citrix.com> Acked-by: Christian Lindig <christian.lindig@citrix.com>