lkml.org 
[lkml]   [2013]   [Feb]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Date
SubjectRe: [PATCH 11/93] xen: Fix stack corruption in xen_failsafe_callback for 32bit PVOPS guests.
At stated before I'm the author of this patch.

Please change the From: to

From: Frediano Ziglio <frediano.ziglio@citrix.com>

Frediano


On Tue, 2013-02-05 at 20:06 -0200, Herton Ronaldo Krzesinski wrote:
> 3.5.7.5 -stable review patch. If anyone has any objections, please let me know.
>
> ------------------
>
> From: Andrew Cooper <andrew.cooper3@citrix.com>
>
> commit 9174adbee4a9a49d0139f5d71969852b36720809 upstream.
>
> This fixes CVE-2013-0190 / XSA-40
>
> There has been an error on the xen_failsafe_callback path for failed
> iret, which causes the stack pointer to be wrong when entering the
> iret_exc error path. This can result in the kernel crashing.
>
> In the classic kernel case, the relevant code looked a little like:
>
> popl %eax # Error code from hypervisor
> jz 5f
> addl $16,%esp
> jmp iret_exc # Hypervisor said iret fault
> 5: addl $16,%esp
> # Hypervisor said segment selector fault
>
> Here, there are two identical addls on either option of a branch which
> appears to have been optimised by hoisting it above the jz, and
> converting it to an lea, which leaves the flags register unaffected.
>
> In the PVOPS case, the code looks like:
>
> popl_cfi %eax # Error from the hypervisor
> lea 16(%esp),%esp # Add $16 before choosing fault path
> CFI_ADJUST_CFA_OFFSET -16
> jz 5f
> addl $16,%esp # Incorrectly adjust %esp again
> jmp iret_exc
>
> It is possible unprivileged userspace applications to cause this
> behaviour, for example by loading an LDT code selector, then changing
> the code selector to be not-present. At this point, there is a race
> condition where it is possible for the hypervisor to return back to
> userspace from an interrupt, fault on its own iret, and inject a
> failsafe_callback into the kernel.
>
> This bug has been present since the introduction of Xen PVOPS support
> in commit 5ead97c84 (xen: Core Xen implementation), in 2.6.23.
>
> Signed-off-by: Frediano Ziglio <frediano.ziglio@citrix.com>
> Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
> Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
> Signed-off-by: Herton Ronaldo Krzesinski <herton.krzesinski@canonical.com>
> ---
> arch/x86/kernel/entry_32.S | 1 -
> 1 file changed, 1 deletion(-)
>
> diff --git a/arch/x86/kernel/entry_32.S b/arch/x86/kernel/entry_32.S
> index 8f8e8ee..2a6919e 100644
> --- a/arch/x86/kernel/entry_32.S
> +++ b/arch/x86/kernel/entry_32.S
> @@ -1065,7 +1065,6 @@ ENTRY(xen_failsafe_callback)
> lea 16(%esp),%esp
> CFI_ADJUST_CFA_OFFSET -16
> jz 5f
> - addl $16,%esp
> jmp iret_exc
> 5: pushl_cfi $-1 /* orig_ax = -1 => not a system call */
> SAVE_ALL

\
 
 \ /
  Last update: 2013-02-06 12:01    [W:0.232 / U:1.096 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site