[x86] kvm: fix page struct leak in handle_vmon (CVE-2017-2596)
This commit is contained in:
parent
93819d25f0
commit
003300166a
|
@ -91,6 +91,7 @@ linux (4.9.13-1) UNRELEASED; urgency=medium
|
||||||
* net: Avoid ABI change for min_header_len
|
* net: Avoid ABI change for min_header_len
|
||||||
* udeb: Add more USB host and dual-role drivers to usb-modules
|
* udeb: Add more USB host and dual-role drivers to usb-modules
|
||||||
(Closes: #856111)
|
(Closes: #856111)
|
||||||
|
* [x86] kvm: fix page struct leak in handle_vmon (CVE-2017-2596)
|
||||||
|
|
||||||
-- Ben Hutchings <ben@decadent.org.uk> Sat, 18 Feb 2017 00:38:10 +0000
|
-- Ben Hutchings <ben@decadent.org.uk> Sat, 18 Feb 2017 00:38:10 +0000
|
||||||
|
|
||||||
|
|
|
@ -0,0 +1,40 @@
|
||||||
|
From: Paolo Bonzini <pbonzini@redhat.com>
|
||||||
|
Date: Tue, 24 Jan 2017 11:56:21 +0100
|
||||||
|
Subject: kvm: fix page struct leak in handle_vmon
|
||||||
|
Origin: https://git.kernel.org/linus/06ce521af9558814b8606c0476c54497cf83a653
|
||||||
|
Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2017-2596
|
||||||
|
|
||||||
|
handle_vmon gets a reference on VMXON region page,
|
||||||
|
but does not release it. Release the reference.
|
||||||
|
|
||||||
|
Found by syzkaller; based on a patch by Dmitry.
|
||||||
|
|
||||||
|
Reported-by: Dmitry Vyukov <dvyukov@google.com>
|
||||||
|
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
|
||||||
|
[bwh: Backported to 4.9: use skip_emulated_instruction()]
|
||||||
|
---
|
||||||
|
--- a/arch/x86/kvm/vmx.c
|
||||||
|
+++ b/arch/x86/kvm/vmx.c
|
||||||
|
@@ -6925,14 +6925,20 @@ static int nested_vmx_check_vmptr(struct
|
||||||
|
}
|
||||||
|
|
||||||
|
page = nested_get_page(vcpu, vmptr);
|
||||||
|
- if (page == NULL ||
|
||||||
|
- *(u32 *)kmap(page) != VMCS12_REVISION) {
|
||||||
|
+ if (page == NULL) {
|
||||||
|
nested_vmx_failInvalid(vcpu);
|
||||||
|
+ skip_emulated_instruction(vcpu);
|
||||||
|
+ return 1;
|
||||||
|
+ }
|
||||||
|
+ if (*(u32 *)kmap(page) != VMCS12_REVISION) {
|
||||||
|
kunmap(page);
|
||||||
|
+ nested_release_page_clean(page);
|
||||||
|
+ nested_vmx_failInvalid(vcpu);
|
||||||
|
skip_emulated_instruction(vcpu);
|
||||||
|
return 1;
|
||||||
|
}
|
||||||
|
kunmap(page);
|
||||||
|
+ nested_release_page_clean(page);
|
||||||
|
vmx->nested.vmxon_ptr = vmptr;
|
||||||
|
break;
|
||||||
|
case EXIT_REASON_VMCLEAR:
|
|
@ -108,6 +108,7 @@ features/all/securelevel/arm64-add-kernel-config-option-to-set-securelevel-wh.pa
|
||||||
|
|
||||||
# Security fixes
|
# Security fixes
|
||||||
debian/i386-686-pae-pci-set-pci-nobios-by-default.patch
|
debian/i386-686-pae-pci-set-pci-nobios-by-default.patch
|
||||||
|
bugfix/x86/kvm-fix-page-struct-leak-in-handle_vmon.patch
|
||||||
|
|
||||||
# Fix exported symbol versions
|
# Fix exported symbol versions
|
||||||
bugfix/ia64/revert-ia64-move-exports-to-definitions.patch
|
bugfix/ia64/revert-ia64-move-exports-to-definitions.patch
|
||||||
|
|
Loading…
Reference in New Issue