File 5e3bd3d1-EFI-dont-leak-heap-VIA-XEN_EFI_get_nex... of Package xen

Overview Repositories Revisions Requests Users Attributes Meta

File 5e3bd3d1-EFI-dont-leak-heap-VIA-XEN_EFI_get_next_variable_name.patch of Package xen (Revision be5cf1a1dd45b6ae162ec4dd28cb2e03)

Currently displaying revision be5cf1a1dd45b6ae162ec4dd28cb2e03 , Show latest

# Commit 4783ee894f6bfb0f4deec9f1fe8e7faceafaa1a2
# Date 2020-02-06 09:52:33 +0100
# Author Jan Beulich <jbeulich@suse.com>
# Committer Jan Beulich <jbeulich@suse.com>
EFI: don't leak heap contents through XEN_EFI_get_next_variable_name

Commit 1f4eb9d27d0e ("EFI: fix getting EFI variable list on some
systems") switched to using the caller provided size for the copy-out
without making sure the copied buffer is properly scrubbed.

Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: George Dunlap <george.dunlap@citrix.com>

--- a/xen/common/efi/runtime.c
+++ b/xen/common/efi/runtime.c
@@ -571,7 +571,7 @@ int efi_runtime_call(struct xenpf_efi_ru
             return -EINVAL;
 
         size = op->u.get_next_variable_name.size;
-        name.raw = xmalloc_bytes(size);
+        name.raw = xzalloc_bytes(size);
         if ( !name.raw )
             return -ENOMEM;
         if ( copy_from_guest(name.raw, op->u.get_next_variable_name.name,

Places

File 5e3bd3d1-EFI-dont-leak-heap-VIA-XEN_EFI_get_next_variable_name.patch of Package xen (Revision be5cf1a1dd45b6ae162ec4dd28cb2e03)

Places