44 lines
1.5 KiB
Diff
44 lines
1.5 KiB
Diff
|
References: bnc#842511 CVE-2013-4368 XSA-67
|
||
|
|
|
||
|
|
# Commit 0771faba163769089c9f05f7f76b63e397677613
|
||
|
|
# Date 2013-10-10 15:19:53 +0200
|
||
|
|
# Author Matthew Daley <mattjd@gmail.com>
|
||
|
|
# Committer Jan Beulich <jbeulich@suse.com>
|
||
|
|
x86: check segment descriptor read result in 64-bit OUTS emulation
|
||
|
|
|
||
|
|
When emulating such an operation from a 64-bit context (CS has long
|
||
|
|
mode set), and the data segment is overridden to FS/GS, the result of
|
||
|
|
reading the overridden segment's descriptor (read_descriptor) is not
|
||
|
|
checked. If it fails, data_base is left uninitialized.
|
||
|
|
|
||
|
|
This can lead to 8 bytes of Xen's stack being leaked to the guest
|
||
|
|
(implicitly, i.e. via the address given in a #PF).
|
||
|
|
|
||
|
|
Coverity-ID: 1055116
|
||
|
|
|
||
|
|
This is CVE-2013-4368 / XSA-67.
|
||
|
|
|
||
|
|
Signed-off-by: Matthew Daley <mattjd@gmail.com>
|
||
|
|
|
||
|
|
Fix formatting.
|
||
|
|
|
||
|
|
Signed-off-by: Jan Beulich <jbeulich@suse.com>
|
||
|
|
|
||
|
|
--- a/xen/arch/x86/traps.c
|
||
|
|
+++ b/xen/arch/x86/traps.c
|
||
|
|
@@ -1990,10 +1990,10 @@ static int emulate_privileged_op(struct
|
||
|
|
break;
|
||
|
|
}
|
||
|
|
}
|
||
|
|
- else
|
||
|
|
- read_descriptor(data_sel, v, regs,
|
||
|
|
- &data_base, &data_limit, &ar,
|
||
|
|
- 0);
|
||
|
|
+ else if ( !read_descriptor(data_sel, v, regs,
|
||
|
|
+ &data_base, &data_limit, &ar, 0) ||
|
||
|
|
+ !(ar & _SEGMENT_S) || !(ar & _SEGMENT_P) )
|
||
|
|
+ goto fail;
|
||
|
|
data_limit = ~0UL;
|
||
|
|
ar = _SEGMENT_WR|_SEGMENT_S|_SEGMENT_DPL|_SEGMENT_P;
|
||
|
|
}
|