linux/arch/x86/kvm
Andrew Honig a08d3b3b99 kvm: x86: fix emulator buffer overflow (CVE-2014-0049)
The problem occurs when the guest performs a pusha with the stack
address pointing to an mmio address (or an invalid guest physical
address) to start with, but then extending into an ordinary guest
physical address.  When doing repeated emulated pushes
emulator_read_write sets mmio_needed to 1 on the first one.  On a
later push when the stack points to regular memory,
mmio_nr_fragments is set to 0, but mmio_is_needed is not set to 0.

As a result, KVM exits to userspace, and then returns to
complete_emulated_mmio.  In complete_emulated_mmio
vcpu->mmio_cur_fragment is incremented.  The termination condition of
vcpu->mmio_cur_fragment == vcpu->mmio_nr_fragments is never achieved.
The code bounces back and fourth to userspace incrementing
mmio_cur_fragment past it's buffer.  If the guest does nothing else it
eventually leads to a a crash on a memcpy from invalid memory address.

However if a guest code can cause the vm to be destroyed in another
vcpu with excellent timing, then kvm_clear_async_pf_completion_queue
can be used by the guest to control the data that's pointed to by the
call to cancel_work_item, which can be used to gain execution.

Fixes: f78146b0f9
Signed-off-by: Andrew Honig <ahonig@google.com>
Cc: stable@vger.kernel.org (3.5+)
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2014-02-27 19:35:22 +01:00
..
cpuid.c kvm, cpuid: Fix sparse warning 2013-11-07 12:27:46 +02:00
cpuid.h KVM: x86: Validate guest writes to MSR_IA32_APICBASE 2014-01-27 14:39:44 +01:00
emulate.c KVM: emulator: cleanup decode_register_operand() a bit 2013-11-05 09:11:30 +02:00
i8254.c KVM: x86: limit PIT timer frequency 2014-01-15 12:43:54 +01:00
i8254.h KVM: fold kvm_pit_timer into kvm_kpit_state 2012-08-01 00:21:07 -03:00
i8259.c KVM: inject ExtINT interrupt before APIC interrupts 2012-12-13 23:05:21 -02:00
irq.c x86, apicv: add virtual interrupt delivery support 2013-01-29 10:48:19 +02:00
irq.h KVM: switch to symbolic name for irq_states size 2012-07-20 16:12:16 -03:00
Kconfig kvm: make KVM_MMU_AUDIT help text more readable 2014-01-20 12:59:26 +01:00
kvm_cache_regs.h
lapic.c First round of KVM updates for 3.14; PPC parts will come next week. 2014-01-22 21:40:43 -08:00
lapic.h KVM: x86: Validate guest writes to MSR_IA32_APICBASE 2014-01-27 14:39:44 +01:00
Makefile kvm: Add VFIO device 2013-10-30 19:02:03 +01:00
mmu_audit.c kvm: mmu: delay mmu audit activation 2013-11-20 11:12:56 +02:00
mmu.c KVM: MMU: drop read-only large sptes when creating lower level sptes 2014-02-26 17:23:32 +01:00
mmu.h KVM: mmu: change useless int return types to void 2013-10-03 15:44:02 +03:00
mmutrace.h KVM: MMU: add tracepoint for check_mmio_spte 2013-06-27 14:20:37 +03:00
paging_tmpl.h KVM: x86: handle invalid root_hpa everywhere 2014-01-15 12:16:16 +01:00
pmu.c perf, kvm: Support the in_tx/in_tx_cp modifiers in KVM arch perfmon emulation v5 2013-07-19 18:24:45 +02:00
svm.c KVM: SVM: Fix reading of DR6 2014-01-17 10:22:10 +01:00
trace.h kvm: Add a tracepoint write_tsc_offset 2013-06-27 14:20:51 +03:00
tss.h
vmx.c KVM: x86: Validate guest writes to MSR_IA32_APICBASE 2014-01-27 14:39:44 +01:00
x86.c kvm: x86: fix emulator buffer overflow (CVE-2014-0049) 2014-02-27 19:35:22 +01:00
x86.h KVM: x86: limit PIT timer frequency 2014-01-15 12:43:54 +01:00