lkml.org 
[lkml]   [2017]   [Jun]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 3.10 006/250] KVM: x86: Introduce segmented_write_std
    Date
    From: Steve Rutherford <srutherford@google.com>

    commit 129a72a0d3c8e139a04512325384fe5ac119e74d upstream.

    Introduces segemented_write_std.

    Switches from emulated reads/writes to standard read/writes in fxsave,
    fxrstor, sgdt, and sidt. This fixes CVE-2017-2584, a longstanding
    kernel memory leak.

    Since commit 283c95d0e389 ("KVM: x86: emulate FXSAVE and FXRSTOR",
    2016-11-09), which is luckily not yet in any final release, this would
    also be an exploitable kernel memory *write*!

    Reported-by: Dmitry Vyukov <dvyukov@google.com>
    Fixes: 96051572c819194c37a8367624b285be10297eca
    Fixes: 283c95d0e3891b64087706b344a4b545d04a6e62
    Suggested-by: Paolo Bonzini <pbonzini@redhat.com>
    Signed-off-by: Steve Rutherford <srutherford@google.com>
    Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
    Signed-off-by: Willy Tarreau <w@1wt.eu>
    ---
    arch/x86/kvm/emulate.c | 18 ++++++++++++++++--
    1 file changed, 16 insertions(+), 2 deletions(-)

    diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
    index 364f020..c964850 100644
    --- a/arch/x86/kvm/emulate.c
    +++ b/arch/x86/kvm/emulate.c
    @@ -906,6 +906,20 @@ static int segmented_read_std(struct x86_emulate_ctxt *ctxt,
    return ctxt->ops->read_std(ctxt, linear, data, size, &ctxt->exception);
    }

    +static int segmented_write_std(struct x86_emulate_ctxt *ctxt,
    + struct segmented_address addr,
    + void *data,
    + unsigned int size)
    +{
    + int rc;
    + ulong linear;
    +
    + rc = linearize(ctxt, addr, size, true, &linear);
    + if (rc != X86EMUL_CONTINUE)
    + return rc;
    + return ctxt->ops->write_std(ctxt, linear, data, size, &ctxt->exception);
    +}
    +
    /*
    * Fetch the next byte of the instruction being emulated which is pointed to
    * by ctxt->_eip, then increment ctxt->_eip.
    @@ -3361,8 +3375,8 @@ static int emulate_store_desc_ptr(struct x86_emulate_ctxt *ctxt,
    }
    /* Disable writeback. */
    ctxt->dst.type = OP_NONE;
    - return segmented_write(ctxt, ctxt->dst.addr.mem,
    - &desc_ptr, 2 + ctxt->op_bytes);
    + return segmented_write_std(ctxt, ctxt->dst.addr.mem,
    + &desc_ptr, 2 + ctxt->op_bytes);
    }

    static int em_sgdt(struct x86_emulate_ctxt *ctxt)
    --
    2.8.0.rc2.1.gbe9624a
    \
     
     \ /
      Last update: 2017-06-12 01:17    [W:2.225 / U:0.272 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site