Information leak through version information hypercall

ISSUE DESCRIPTION

The code handling certain sub-operations of the HYPERVISOR_xen_version hypercall fails to fully initialize all fields of structures subsequently copied back to guest memory. Due to this hypervisor stack contents are copied into the destination of the operation, thus becoming visible to the guest.

IMPACT

A malicious guest might be able to read sensitive data relating to other guests.

VULNERABLE SYSTEMS

Xen 3.2.x and later are vulnerable. Xen 3.1.x and earlier have not been inspected.