From: Greg Kroah-Hartman Date: Mon, 16 Aug 2021 19:27:57 +0000 (+0200) Subject: 4.9-stable patches X-Git-Tag: v5.4.142~4 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=431ea895014e4749e0047f101bb16099746ad297;p=thirdparty%2Fkernel%2Fstable-queue.git 4.9-stable patches added patches: kvm-nsvm-avoid-picking-up-unsupported-bits-from-l2-in-int_ctl-cve-2021-3653.patch --- diff --git a/queue-4.9/kvm-nsvm-avoid-picking-up-unsupported-bits-from-l2-in-int_ctl-cve-2021-3653.patch b/queue-4.9/kvm-nsvm-avoid-picking-up-unsupported-bits-from-l2-in-int_ctl-cve-2021-3653.patch new file mode 100644 index 00000000000..db9860d18ee --- /dev/null +++ b/queue-4.9/kvm-nsvm-avoid-picking-up-unsupported-bits-from-l2-in-int_ctl-cve-2021-3653.patch @@ -0,0 +1,56 @@ +From foo@baz Mon Aug 16 09:26:03 PM CEST 2021 +From: Paolo Bonzini +Date: Mon, 16 Aug 2021 16:02:32 +0200 +Subject: KVM: nSVM: avoid picking up unsupported bits from L2 in int_ctl (CVE-2021-3653) +To: linux-kernel@vger.kernel.org, kvm@vger.kernel.org +Cc: stable@vger.kernel.org, Maxim Levitsky +Message-ID: <20210816140240.11399-4-pbonzini@redhat.com> + +From: Maxim Levitsky + +[ upstream commit 0f923e07124df069ba68d8bb12324398f4b6b709 ] + +* Invert the mask of bits that we pick from L2 in + nested_vmcb02_prepare_control + +* Invert and explicitly use VIRQ related bits bitmask in svm_clear_vintr + +This fixes a security issue that allowed a malicious L1 to run L2 with +AVIC enabled, which allowed the L2 to exploit the uninitialized and enabled +AVIC to read/write the host physical memory at some offsets. + +Fixes: 3d6368ef580a ("KVM: SVM: Add VMRUN handler") +Signed-off-by: Maxim Levitsky +Signed-off-by: Paolo Bonzini +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/include/asm/svm.h | 2 ++ + arch/x86/kvm/svm.c | 6 +++++- + 2 files changed, 7 insertions(+), 1 deletion(-) + +--- a/arch/x86/include/asm/svm.h ++++ b/arch/x86/include/asm/svm.h +@@ -113,6 +113,8 @@ struct __attribute__ ((__packed__)) vmcb + #define V_IGN_TPR_SHIFT 20 + #define V_IGN_TPR_MASK (1 << V_IGN_TPR_SHIFT) + ++#define V_IRQ_INJECTION_BITS_MASK (V_IRQ_MASK | V_INTR_PRIO_MASK | V_IGN_TPR_MASK) ++ + #define V_INTR_MASKING_SHIFT 24 + #define V_INTR_MASKING_MASK (1 << V_INTR_MASKING_SHIFT) + +--- a/arch/x86/kvm/svm.c ++++ b/arch/x86/kvm/svm.c +@@ -3048,7 +3048,11 @@ static bool nested_svm_vmrun(struct vcpu + svm->nested.intercept = nested_vmcb->control.intercept; + + svm_flush_tlb(&svm->vcpu); +- svm->vmcb->control.int_ctl = nested_vmcb->control.int_ctl | V_INTR_MASKING_MASK; ++ svm->vmcb->control.int_ctl = nested_vmcb->control.int_ctl & ++ (V_TPR_MASK | V_IRQ_INJECTION_BITS_MASK); ++ ++ svm->vmcb->control.int_ctl |= V_INTR_MASKING_MASK; ++ + if (nested_vmcb->control.int_ctl & V_INTR_MASKING_MASK) + svm->vcpu.arch.hflags |= HF_VINTR_MASK; + else diff --git a/queue-4.9/series b/queue-4.9/series index 255b3fbbb38..40d636400e2 100644 --- a/queue-4.9/series +++ b/queue-4.9/series @@ -15,3 +15,4 @@ pci-msi-use-msi_mask_irq-in-pci_msi_shutdown.patch pci-msi-protect-msi_desc-masked-for-multi-msi.patch vmlinux.lds.h-handle-clang-s-module.-c-d-tor-sections.patch mac80211-drop-data-frames-without-key-on-encrypted-links.patch +kvm-nsvm-avoid-picking-up-unsupported-bits-from-l2-in-int_ctl-cve-2021-3653.patch