[Xen-devel] [PATCH] libxc: restore: bounds check for start_info.{store_mfn, console.domU.mfn}

[Ian Jackson <Ian.Jackson@xxxxxxxxxxxxx>]

Ian Campbell writes ("[PATCH] libxc: restore: bounds check for 
start_info.{store_mfn, console.domU.mfn}"):
> libxc: restore: bounds check for start_info.{store_mfn,console.domU.mfn}
> 
> These fields are canonicalised by the guest on suspend and therefore must be
> valid pfns during restore.
> 
> Reported-by: Jonathan Ludlam <Jonathan.Ludlam@xxxxxxxxxxxxx>
> Signed-off-by: Ian Campbell <ian.campbell@xxxxxxxxxx>

Does this mean that a malicious restore file can take over the
toolstack ?

Ian.

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
http://lists.xen.org/xen-devel