Re: [Xen-devel] [PATCH] [v2] xen: hypercall: fix out-of-bounds memcpy

[David Laight <David.Laight@xxxxxxxxxx>]

From: Andrew Cooper
> Sent: 05 February 2018 15:14
> 
> On 05/02/18 15:03, Arnd Bergmann wrote:
> 
> Snipping deleted code to make things clearer:
> 
> > +   if (cmd > ARRAY_SIZE(physdevop_len))
> > +           return -ENOSYS;
> >
> > +   len = physdevop_len[cmd];
> > +   memcpy(&op.u, arg, len);
> 
> You'll want an array_nospec() or whatever its called these days.  This
> code is SP1-leaky.
> 
> Userspace controls cmd and can retrieve len by timing how many adjacent
> cache lines were pulled in my memcpy().

Well, maybe it can read beyond the bounds of physdevop_len[].
I doubt that the memcpy() will pull in many cache lines so you
can probably only determine whether the value is 0..63, 64..127 or 128+
Not likely to be much use.

        David

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxxx
https://lists.xenproject.org/mailman/listinfo/xen-devel