@@ -147,6 +147,7 @@ static void init_hypercalls(void)
/* Print version information. */
cpuid(base + 1, &eax, &ebx, &ecx, &edx);
hypercall_xen_version(XENVER_extraversion, extraversion);
+ xsm_filter_denied(extraversion);
printf("Detected Xen v%u.%u%s\n", eax >> 16, eax & 0xffff, extraversion);
}
@@ -275,6 +275,7 @@ hvm_write_smbios_tables(
xen_minor_version = (uint16_t) xen_version;
hypercall_xen_version(XENVER_extraversion, xen_extra_version);
+ xsm_filter_denied(xen_extra_version);
/* build up human-readable Xen version string */
p = xen_version_str;
@@ -28,6 +28,7 @@
#include <xen/xen.h>
#include <xen/memory.h>
#include <xen/sched.h>
+#include <xen/version.h>
#include <xen/hvm/hvm_xs_strings.h>
#include <xen/hvm/params.h>
@@ -995,6 +996,16 @@ void hvmloader_acpi_build_tables(struct acpi_config *config,
hvm_param_set(HVM_PARAM_VM_GENERATION_ID_ADDR, config->vm_gid_addr);
}
+void xsm_filter_denied(char *str)
+{
+ xen_denied_string_t deny_str = "";
+
+ hypercall_xen_version(XENVER_denied_string, deny_str);
+
+ if ( strcmp(str, deny_str) == 0 )
+ *str = '\0';
+}
+
/*
* Local variables:
* mode: C
@@ -286,6 +286,8 @@ struct acpi_config;
void hvmloader_acpi_build_tables(struct acpi_config *config,
unsigned int physical);
+void xsm_filter_denied(char *str);
+
#endif /* __HVMLOADER_UTIL_H__ */
/*
@@ -751,16 +751,23 @@ static XSM_INLINE int xsm_xen_version (XSM_DEFAULT_ARG uint32_t op)
case XENVER_denied_string:
/* These sub-ops ignore the permission checks and return data. */
return 0;
- case XENVER_extraversion:
- case XENVER_compile_info:
+
case XENVER_capabilities:
- case XENVER_changeset:
case XENVER_pagesize:
case XENVER_guest_handle:
/* These MUST always be accessible to any guest by default. */
return xsm_default_action(XSM_HOOK, current->domain, NULL);
- default:
+
+ case XENVER_extraversion:
+ case XENVER_compile_info:
+ case XENVER_changeset:
+ case XENVER_commandline:
+ case XENVER_build_id:
return xsm_default_action(XSM_PRIV, current->domain, NULL);
+
+ default:
+ ASSERT_UNREACHABLE();
+ return -EPERM;
}
}
Hide the following information that can help identify the running Xen binary version: XENVER_[extraversion|compile_info|changeset] This makes harder for malicious guests to fingerprint Xen to identify exploitable systems. Introduce xsm_filter_denied() to hvmloader to remove "<denied>" string from guest's DMI tables that otherwise would be shown in tools like dmidecode. While at it, add explicit cases for XENVER_[commandline|build_id] for better code readability. Add a default case with an ASSERT to make sure that every case is explicitly listed as well. Signed-off-by: Sergey Dyasli <sergey.dyasli@citrix.com> --- v3 --> v4: - Updated commit message - Re-add hvmloader filtering v2 --> v3: - Remove hvmloader filtering - Add ASSERT_UNREACHABLE v1 --> v2: - Added xsm_filter_denied() to hvmloader instead of modifying xen_deny() - Made behaviour the same for both Release and Debug builds - XENVER_capabilities is no longer hided --- tools/firmware/hvmloader/hvmloader.c | 1 + tools/firmware/hvmloader/smbios.c | 1 + tools/firmware/hvmloader/util.c | 11 +++++++++++ tools/firmware/hvmloader/util.h | 2 ++ xen/include/xsm/dummy.h | 15 +++++++++++---- 5 files changed, 26 insertions(+), 4 deletions(-)