lkml.org 
[lkml]   [2013]   [Jun]   [4]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[ 057/184] KVM: Fix bounds checking in ioapic indirect register
    2.6.32-longterm review patch.  If anyone has any objections, please let me know.

    ------------------
    reads (CVE-2013-1798)

    From: Andy Honig <ahonig@google.com>

    commit a2c118bfab8bc6b8bb213abfc35201e441693d55 upstream.

    If the guest specifies a IOAPIC_REG_SELECT with an invalid value and follows
    that with a read of the IOAPIC_REG_WINDOW KVM does not properly validate
    that request. ioapic_read_indirect contains an
    ASSERT(redir_index < IOAPIC_NUM_PINS), but the ASSERT has no effect in
    non-debug builds. In recent kernels this allows a guest to cause a kernel
    oops by reading invalid memory. In older kernels (pre-3.3) this allows a
    guest to read from large ranges of host memory.

    Tested: tested against apic unit tests.

    Signed-off-by: Andrew Honig <ahonig@google.com>
    Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
    Cc: Ben Hutchings <ben@decadent.org.uk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: Willy Tarreau <w@1wt.eu>
    ---
    virt/kvm/ioapic.c | 7 +++++--
    1 file changed, 5 insertions(+), 2 deletions(-)

    diff --git a/virt/kvm/ioapic.c b/virt/kvm/ioapic.c
    index 9fe140b..69969ae 100644
    --- a/virt/kvm/ioapic.c
    +++ b/virt/kvm/ioapic.c
    @@ -71,9 +71,12 @@ static unsigned long ioapic_read_indirect(struct kvm_ioapic *ioapic,
    u32 redir_index = (ioapic->ioregsel - 0x10) >> 1;
    u64 redir_content;

    - ASSERT(redir_index < IOAPIC_NUM_PINS);
    + if (redir_index < IOAPIC_NUM_PINS)
    + redir_content =
    + ioapic->redirtbl[redir_index].bits;
    + else
    + redir_content = ~0ULL;

    - redir_content = ioapic->redirtbl[redir_index].bits;
    result = (ioapic->ioregsel & 0x1) ?
    (redir_content >> 32) & 0xffffffff :
    redir_content & 0xffffffff;
    --
    1.7.12.2.21.g234cd45.dirty




    \
     
     \ /
      Last update: 2013-06-05 02:01    [W:4.057 / U:0.072 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site