4cdbb395f2
grub2-x86_64-xen dependency not available xen.spec - More cleanup of README.SUSE - Update xen patch with upstream patch so that latest libvirt patch can work. (bnc#896044) + 53fcebab-xen-pass-kernel-initrd-to-qemu.patch - xen-pass-kernel-initrd-to-qemu.patch - bnc#895804 - VUL-0: CVE-2014-6268: xen: XSA-107: Mishandling of uninitialised FIFO-based event channel control blocks xsa107.patch - bnc#895802 - VUL-0: xen: XSA-106: Missing privilege level checks in x86 emulation of software interrupts xsa106.patch - bnc#895799 - VUL-0: xen: XSA-105: Missing privilege level checks in x86 HLT, LGDT, LIDT, and LMSW emulation xsa105.patch - bnc#895798 - VUL-0: xen: XSA-104: Race condition in HVMOP_track_dirty_vram xsa104.patch OBS-URL: https://build.opensuse.org/package/show/Virtualization/xen?expand=0&rev=331
23 lines
871 B
Diff
23 lines
871 B
Diff
x86emul: only emulate software interrupt injection for real mode
|
|
|
|
Protected mode emulation currently lacks proper privilege checking of
|
|
the referenced IDT entry, and there's currently no legitimate way for
|
|
any of the respective instructions to reach the emulator when the guest
|
|
is in protected mode.
|
|
|
|
This is XSA-106.
|
|
|
|
Signed-off-by: Jan Beulich <jbeulich@suse.com>
|
|
Acked-by: Keir Fraser <keir@xen.org>
|
|
|
|
--- a/xen/arch/x86/x86_emulate/x86_emulate.c
|
|
+++ b/xen/arch/x86/x86_emulate/x86_emulate.c
|
|
@@ -2634,6 +2634,7 @@ x86_emulate(
|
|
case 0xcd: /* int imm8 */
|
|
src.val = insn_fetch_type(uint8_t);
|
|
swint:
|
|
+ fail_if(!in_realmode(ctxt, ops)); /* XSA-106 */
|
|
fail_if(ops->inject_sw_interrupt == NULL);
|
|
rc = ops->inject_sw_interrupt(src.val, _regs.eip - ctxt->regs->eip,
|
|
ctxt) ? : X86EMUL_EXCEPTION;
|