All of lore.kernel.org
 help / color / mirror / Atom feed
From: Paolo Bonzini <pbonzini@redhat.com>
To: linux-kernel@vger.kernel.org, kvm@vger.kernel.org
Cc: lprosek@redhat.com, ahonig@google.com
Subject: [PATCH 1/2] KVM: nVMX: update last_nonleaf_level when initializing nested EPT
Date: Tue, 10 Oct 2017 17:30:58 +0200	[thread overview]
Message-ID: <1507649459-144559-2-git-send-email-pbonzini@redhat.com> (raw)
In-Reply-To: <1507649459-144559-1-git-send-email-pbonzini@redhat.com>

From: Ladi Prosek <lprosek@redhat.com>

The function updates context->root_level but didn't call
update_last_nonleaf_level so the previous and potentially wrong value
was used for page walks.  For example, a zero value of last_nonleaf_level
would allow a potential out-of-bounds access in arch/x86/mmu/paging_tmpl.h's
walk_addr_generic function (CVE-2017-12188).

Fixes: 155a97a3d7c78b46cef6f1a973c831bc5a4f82bb
Signed-off-by: Ladi Prosek <lprosek@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 arch/x86/kvm/mmu.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
index 106d4a029a8a..3c25f20115bc 100644
--- a/arch/x86/kvm/mmu.c
+++ b/arch/x86/kvm/mmu.c
@@ -4555,6 +4555,7 @@ void kvm_init_shadow_ept_mmu(struct kvm_vcpu *vcpu, bool execonly,
 
 	update_permission_bitmask(vcpu, context, true);
 	update_pkru_bitmask(vcpu, context, true);
+	update_last_nonleaf_level(vcpu, context);
 	reset_rsvds_bits_mask_ept(vcpu, context, execonly);
 	reset_ept_shadow_zero_bits_mask(vcpu, context, execonly);
 }
-- 
1.8.3.1

  reply	other threads:[~2017-10-10 15:31 UTC|newest]

Thread overview: 4+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2017-10-10 15:30 [PATCH 0/2] KVM: nVMX: fix out-of-bounds access (CVE-2017-12188) Paolo Bonzini
2017-10-10 15:30 ` Paolo Bonzini [this message]
2017-10-10 15:30 ` [PATCH 2/2] KVM: MMU: always terminate page walks at level 1 Paolo Bonzini
2017-10-12 11:59 [PATCH 0/2] KVM: nVMX: fix out-of-bounds access (CVE-2017-12188) Paolo Bonzini
2017-10-12 11:59 ` [PATCH 1/2] KVM: nVMX: update last_nonleaf_level when initializing nested EPT Paolo Bonzini

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=1507649459-144559-2-git-send-email-pbonzini@redhat.com \
    --to=pbonzini@redhat.com \
    --cc=ahonig@google.com \
    --cc=kvm@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=lprosek@redhat.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.