misplaced free in ocaml xc_vcpu_getaffinity stub

ISSUE DESCRIPTION

The ocaml binding for the xc_vcpu_getaffinity function incorrectly frees a pointer before using it and subsequently freeing it again afterwards. The code therefore contains a use-after-free and double-free flaws.

IMPACT

An attacker may be able to cause a multithreaded toolstack written in ocaml and using this function to race against itself leading to heap corruption and a potential DoS.
Depending on the malloc implementation code execution cannot be ruled out.

VULNERABLE SYSTEMS

The flaw is present in Xen 4.2 onwards.
Systems using an ocaml based toolstack (e.g. xapi) are vulnerable.