Messages in this thread Patch in this message | | | Date | Thu, 23 Apr 2015 17:10:47 +0200 | From | Borislav Petkov <> | Subject | Re: [PATCH] x86/asm/entry/64: better check for canonical address |
| |
On Tue, Apr 21, 2015 at 11:08:42AM -0700, Andy Lutomirski wrote: > I'll take a full implementation of what Intel says over probably > unmeasurable performance. If anyone in the AMD camp really cared, we > could add X86_BUG_SYSRET_NEEDS_CANONICAL_RCX and use alternatives to > patch this out on AMD. I doubt this would buy us much.
Err, why do we care if RCX is canonical when executing SYSRET?
The RIP canonicalness test is being done anyway and we read RIP from RCX. What am I missing?
Oh, and then there's this:
http://lists.xen.org/archives/html/xen-announce/2012-06/msg00001.html
and more specifically:
"AMD have issued the following statement:
AMD processors' SYSRET behavior is such that a non-canonical address in RCX does not generate a #GP while in CPL0. We have verified this with our architecture team, with our design team, and have performed tests that verified this on silicon. Therefore, this privilege escalation exposure is not applicable to any AMD processor. "
oh, and look at one of the xen fixes, hahaha! (at the end). Intel faults in ring0 due to non-canonical RCX but with user RSP. Lovely.
--- x86_64: Do not execute sysret with a non-canonical return address
Check for non-canonical guest RIP before attempting to execute sysret. If sysret is executed with a non-canonical value in RCX, Intel CPUs take the fault in ring0, but we will necessarily already have switched to the the user's stack pointer.
This is a security vulnerability, XSA-7 / CVE-2012-0217.
Signed-off-by: Jan Beulich <JBeulich@suse.com> Signed-off-by: Ian Campbell <Ian.Campbell@citrix.com> Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com> Tested-by: Ian Campbell <Ian.Campbell@citrix.com> Acked-by: Keir Fraser <keir.xen@gmail.com> Committed-by: Ian Jackson <ian.jackson@eu.citrix.com>
diff -r 340062faf298 -r ad87903fdca1 xen/arch/x86/x86_64/entry.S --- a/xen/arch/x86/x86_64/entry.S Wed May 23 11:06:49 2012 +0100 +++ b/xen/arch/x86/x86_64/entry.S Thu May 24 11:02:35 2012 +0100 @@ -40,6 +40,13 @@ restore_all_guest: testw $TRAP_syscall,4(%rsp) jz iret_exit_to_guest + /* Don't use SYSRET path if the return address is not canonical. */ + movq 8(%rsp),%rcx + sarq $47,%rcx + incl %ecx + cmpl $1,%ecx + ja .Lforce_iret + addq $8,%rsp popq %rcx # RIP popq %r11 # CS @@ -50,6 +57,10 @@ restore_all_guest: sysretq 1: sysretl +.Lforce_iret: + /* Mimic SYSRET behavior. */ + movq 8(%rsp),%rcx # RIP + movq 24(%rsp),%r11 # RFLAGS ALIGN /* No special register assumptions. */ iret_exit_to_guest: --- Thanks.
-- Regards/Gruss, Boris.
ECO tip #101: Trim your mails when you reply. --
| |