]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
KVM: x86: Introduce segmented_write_std
authorSteve Rutherford <srutherford@google.com>
Thu, 12 Jan 2017 02:28:29 +0000 (18:28 -0800)
committerBen Hutchings <ben@decadent.org.uk>
Sun, 26 Feb 2017 20:01:49 +0000 (20:01 +0000)
commit8be074a1f62ff51ffdf5b4634327dee351a5c2c2
treec993ad052b6435835d70ce6f180ceca984649217
parent448ec74e72bf4c5952e3d369720a862da99c0895
KVM: x86: Introduce segmented_write_std

commit 129a72a0d3c8e139a04512325384fe5ac119e74d upstream.

Introduces segemented_write_std.

Switches from emulated reads/writes to standard read/writes in fxsave,
fxrstor, sgdt, and sidt.  This fixes CVE-2017-2584, a longstanding
kernel memory leak.

Since commit 283c95d0e389 ("KVM: x86: emulate FXSAVE and FXRSTOR",
2016-11-09), which is luckily not yet in any final release, this would
also be an exploitable kernel memory *write*!

Reported-by: Dmitry Vyukov <dvyukov@google.com>
Fixes: 96051572c819194c37a8367624b285be10297eca
Fixes: 283c95d0e3891b64087706b344a4b545d04a6e62
Suggested-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Steve Rutherford <srutherford@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
[bwh: Backported to 3.16: drop changes to em_fxsave(), em_fxrstor()]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
arch/x86/kvm/emulate.c