From 003300166ad106537b7669b452bc3035a2f6bd20 Mon Sep 17 00:00:00 2001 From: Ben Hutchings Date: Sun, 26 Feb 2017 20:29:29 +0000 Subject: [PATCH] [x86] kvm: fix page struct leak in handle_vmon (CVE-2017-2596) --- debian/changelog | 1 + ...-fix-page-struct-leak-in-handle_vmon.patch | 40 +++++++++++++++++++ debian/patches/series | 1 + 3 files changed, 42 insertions(+) create mode 100644 debian/patches/bugfix/x86/kvm-fix-page-struct-leak-in-handle_vmon.patch diff --git a/debian/changelog b/debian/changelog index 9d2b8533e..6e738f123 100644 --- a/debian/changelog +++ b/debian/changelog @@ -91,6 +91,7 @@ linux (4.9.13-1) UNRELEASED; urgency=medium * net: Avoid ABI change for min_header_len * udeb: Add more USB host and dual-role drivers to usb-modules (Closes: #856111) + * [x86] kvm: fix page struct leak in handle_vmon (CVE-2017-2596) -- Ben Hutchings Sat, 18 Feb 2017 00:38:10 +0000 diff --git a/debian/patches/bugfix/x86/kvm-fix-page-struct-leak-in-handle_vmon.patch b/debian/patches/bugfix/x86/kvm-fix-page-struct-leak-in-handle_vmon.patch new file mode 100644 index 000000000..0f79e139d --- /dev/null +++ b/debian/patches/bugfix/x86/kvm-fix-page-struct-leak-in-handle_vmon.patch @@ -0,0 +1,40 @@ +From: Paolo Bonzini +Date: Tue, 24 Jan 2017 11:56:21 +0100 +Subject: kvm: fix page struct leak in handle_vmon +Origin: https://git.kernel.org/linus/06ce521af9558814b8606c0476c54497cf83a653 +Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2017-2596 + +handle_vmon gets a reference on VMXON region page, +but does not release it. Release the reference. + +Found by syzkaller; based on a patch by Dmitry. + +Reported-by: Dmitry Vyukov +Signed-off-by: Paolo Bonzini +[bwh: Backported to 4.9: use skip_emulated_instruction()] +--- +--- a/arch/x86/kvm/vmx.c ++++ b/arch/x86/kvm/vmx.c +@@ -6925,14 +6925,20 @@ static int nested_vmx_check_vmptr(struct + } + + page = nested_get_page(vcpu, vmptr); +- if (page == NULL || +- *(u32 *)kmap(page) != VMCS12_REVISION) { ++ if (page == NULL) { + nested_vmx_failInvalid(vcpu); ++ skip_emulated_instruction(vcpu); ++ return 1; ++ } ++ if (*(u32 *)kmap(page) != VMCS12_REVISION) { + kunmap(page); ++ nested_release_page_clean(page); ++ nested_vmx_failInvalid(vcpu); + skip_emulated_instruction(vcpu); + return 1; + } + kunmap(page); ++ nested_release_page_clean(page); + vmx->nested.vmxon_ptr = vmptr; + break; + case EXIT_REASON_VMCLEAR: diff --git a/debian/patches/series b/debian/patches/series index 848611101..28509ec98 100644 --- a/debian/patches/series +++ b/debian/patches/series @@ -108,6 +108,7 @@ features/all/securelevel/arm64-add-kernel-config-option-to-set-securelevel-wh.pa # Security fixes debian/i386-686-pae-pci-set-pci-nobios-by-default.patch +bugfix/x86/kvm-fix-page-struct-leak-in-handle_vmon.patch # Fix exported symbol versions bugfix/ia64/revert-ia64-move-exports-to-definitions.patch