Public Security Advisories
Coordinated vulnerability disclosures from Argus. Findings, impact, and remediation, published in good faith.
The function reads a host-controlled file-directory count from QEMU fw_cfg via QemuFwCfgRead32() and uses it to size an AllocatePool call without checking the return value for NULL.
In the multi-vCPU boot-time memory-acceptance path, BspApAcceptMemoryResourceRange calls TdAcceptPages (which performs TDCALL(TDACCEPTPAGE)) and stores the result in Status.
XenStoreProcessMessage reads an xsd_sockmsg header (containing a 32-bit Header.len field) from the XenStore shared-memory ring, which is populated by the Xen host/dom0 toolstack.
In the XenStore string-list parsing helper Split, Dst = AllocatePool(*NumPtr * sizeof(CHAR8 *) + Len) has NO NULL CHECK before CopyMem at line 233 writes through it via &Dst[*NumPtr].
In XenStoreJoin, Buf = AllocatePool(BufSize) is guarded only by ASSERT(Buf != NULL) — a no-op in RELEASE builds.
In XenStoreVSPrint, Buf = AllocateZeroPool(BufSize) has NO NULL CHECK before it is passed to AsciiVSPrint(Buf, BufSize, FormatString, Marker) at line 1383 and to XenStoreWrite at line 1384.
In the XenBusDxe driver binding Start function (XenBusDxeDriverBindingStart, line 312), Dev = AllocateZeroPool(sizeof(*Dev)) has NO NULL CHECK before Dev->Signature = XENBUS_DEVICE_SIGNATURE at line 350 dereferences it.
In XenStoreProcessMessage, a XENSTORE_MESSAGE is allocated with AllocateZeroPool(sizeof(XENSTORE_MESSAGE)) without checking for NULL.
In XenStoreRegisterWatch, a XENSTORE_WATCH is allocated with AllocateZeroPool(sizeof(XENSTORE_WATCH)) without checking for NULL.
// No embargoed advisories.