63 lines
2.0 KiB
Diff
63 lines
2.0 KiB
Diff
|
References: bnc#849665 CVE-2013-4551 XSA-75
|
||
|
|
|
||
|
|
# Commit 4e87bc5b03e05123ba5c888f77969140c8ebd1bf
|
||
|
|
# Date 2013-11-11 09:15:04 +0100
|
||
|
|
# Author Jan Beulich <jbeulich@suse.com>
|
||
|
|
# Committer Jan Beulich <jbeulich@suse.com>
|
||
|
|
nested VMX: VMLANUCH/VMRESUME emulation must check permission first thing
|
||
|
|
|
||
|
|
Otherwise uninitialized data may be used, leading to crashes.
|
||
|
|
|
||
|
|
This is CVE-2013-4551 / XSA-75.
|
||
|
|
|
||
|
|
Reported-and-tested-by: Jeff Zimmerman <Jeff_Zimmerman@McAfee.com>
|
||
|
|
Signed-off-by: Jan Beulich <jbeulich@suse.com>
|
||
|
|
Reviewed-and-tested-by: Andrew Cooper <andrew.cooper3@citrix.com>
|
||
|
|
Acked-by: Ian Campbell <ian.campbell@citrix.com>
|
||
|
|
|
||
|
|
--- a/xen/arch/x86/hvm/vmx/vvmx.c
|
||
|
|
+++ b/xen/arch/x86/hvm/vmx/vvmx.c
|
||
|
|
@@ -1508,15 +1508,10 @@ static void clear_vvmcs_launched(struct
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
-int nvmx_vmresume(struct vcpu *v, struct cpu_user_regs *regs)
|
||
|
|
+static int nvmx_vmresume(struct vcpu *v, struct cpu_user_regs *regs)
|
||
|
|
{
|
||
|
|
struct nestedvmx *nvmx = &vcpu_2_nvmx(v);
|
||
|
|
struct nestedvcpu *nvcpu = &vcpu_nestedhvm(v);
|
||
|
|
- int rc;
|
||
|
|
-
|
||
|
|
- rc = vmx_inst_check_privilege(regs, 0);
|
||
|
|
- if ( rc != X86EMUL_OKAY )
|
||
|
|
- return rc;
|
||
|
|
|
||
|
|
/* check VMCS is valid and IO BITMAP is set */
|
||
|
|
if ( (nvcpu->nv_vvmcxaddr != VMCX_EADDR) &&
|
||
|
|
@@ -1535,6 +1530,10 @@ int nvmx_handle_vmresume(struct cpu_user
|
||
|
|
struct vcpu *v = current;
|
||
|
|
struct nestedvcpu *nvcpu = &vcpu_nestedhvm(v);
|
||
|
|
struct nestedvmx *nvmx = &vcpu_2_nvmx(v);
|
||
|
|
+ int rc = vmx_inst_check_privilege(regs, 0);
|
||
|
|
+
|
||
|
|
+ if ( rc != X86EMUL_OKAY )
|
||
|
|
+ return rc;
|
||
|
|
|
||
|
|
if ( vcpu_nestedhvm(v).nv_vvmcxaddr == VMCX_EADDR )
|
||
|
|
{
|
||
|
|
@@ -1554,10 +1553,13 @@ int nvmx_handle_vmresume(struct cpu_user
|
||
|
|
int nvmx_handle_vmlaunch(struct cpu_user_regs *regs)
|
||
|
|
{
|
||
|
|
bool_t launched;
|
||
|
|
- int rc;
|
||
|
|
struct vcpu *v = current;
|
||
|
|
struct nestedvcpu *nvcpu = &vcpu_nestedhvm(v);
|
||
|
|
struct nestedvmx *nvmx = &vcpu_2_nvmx(v);
|
||
|
|
+ int rc = vmx_inst_check_privilege(regs, 0);
|
||
|
|
+
|
||
|
|
+ if ( rc != X86EMUL_OKAY )
|
||
|
|
+ return rc;
|
||
|
|
|
||
|
|
if ( vcpu_nestedhvm(v).nv_vvmcxaddr == VMCX_EADDR )
|
||
|
|
{
|