CVE-2014-9090 local DoS via do_double_fault due to improper SS faults (rhbz 1170691)
This commit is contained in:
Josh Boyer
parent
f9fd7fc77f
commit
048351e55e
11
kernel.spec
11
kernel.spec
|
|
@ -631,6 +631,9 @@ Patch26073: Input-xpad-use-proper-endpoint-type.patch
|
|||
|
||||
Patch26074: drm-i915-Ignore-long-hpds-on-eDP-ports.patch
|
||||
|
||||
#CVE-2014-9090 rhbz 1170691
|
||||
Patch26075: x86_64-traps-Stop-using-IST-for-SS.patch
|
||||
|
||||
# git clone ssh://git.fedorahosted.org/git/kernel-arm64.git, git diff master...devel
|
||||
Patch30000: kernel-arm64.patch
|
||||
|
||||
|
|
@ -1373,6 +1376,9 @@ ApplyPatch Input-xpad-use-proper-endpoint-type.patch
|
|||
|
||||
ApplyPatch drm-i915-Ignore-long-hpds-on-eDP-ports.patch
|
||||
|
||||
#CVE-2014-9090 rhbz 1170691
|
||||
ApplyPatch x86_64-traps-Stop-using-IST-for-SS.patch
|
||||
|
||||
%if 0%{?aarch64patches}
|
||||
ApplyPatch kernel-arm64.patch
|
||||
%ifnarch aarch64 # this is stupid, but i want to notice before secondary koji does.
|
||||
|
|
@ -2246,7 +2252,10 @@ fi
|
|||
# ||----w |
|
||||
# || ||
|
||||
%changelog
|
||||
* Thu Dec 04 2014 Kyle McMartin <kyle@fedoraproject.org> - 3.17.4-302
|
||||
* Thu Dec 04 2014 Josh Boyer <jwboyer@fedoraproject.org> - 3.17.4-302
|
||||
- CVE-2014-9090 local DoS via do_double_fault due to improper SS faults (rhbz 1170691)
|
||||
|
||||
* Thu Dec 04 2014 Kyle McMartin <kyle@fedoraproject.org>
|
||||
- kernel-arm64.patch: update.
|
||||
- arm64-force-serial-to-be-active-consdev.patch: force serial consoles
|
||||
to be the primary console device instead of defaulting to tty0. No
|
||||
|
|
|
|||
|
|
@ -0,0 +1,145 @@
|
|||
From: Andy Lutomirski <luto@amacapital.net>
|
||||
Date: Sat, 22 Nov 2014 18:00:32 -0800
|
||||
Subject: [PATCH] x86_64, traps: Stop using IST for #SS
|
||||
|
||||
On a 32-bit kernel, this has no effect, since there are no IST stacks.
|
||||
|
||||
On a 64-bit kernel, #SS can only happen in user code, on a failed iret
|
||||
to user space, a canonical violation on access via RSP or RBP, or a
|
||||
genuine stack segment violation in 32-bit kernel code. The first two
|
||||
cases don't need IST, and the latter two cases are unlikely fatal bugs,
|
||||
and promoting them to double faults would be fine.
|
||||
|
||||
This fixes a bug in which the espfix64 code mishandles a stack segment
|
||||
violation.
|
||||
|
||||
This saves 4k of memory per CPU and a tiny bit of code.
|
||||
|
||||
Signed-off-by: Andy Lutomirski <luto@amacapital.net>
|
||||
Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
|
||||
Cc: stable@vger.kernel.org
|
||||
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
||||
---
|
||||
arch/x86/include/asm/page_32_types.h | 1 -
|
||||
arch/x86/include/asm/page_64_types.h | 11 +++++------
|
||||
arch/x86/include/asm/traps.h | 1 +
|
||||
arch/x86/kernel/dumpstack_64.c | 1 -
|
||||
arch/x86/kernel/entry_64.S | 2 +-
|
||||
arch/x86/kernel/traps.c | 18 +-----------------
|
||||
6 files changed, 8 insertions(+), 26 deletions(-)
|
||||
|
||||
diff --git a/arch/x86/include/asm/page_32_types.h b/arch/x86/include/asm/page_32_types.h
|
||||
index f48b17df4224..3a52ee0e726d 100644
|
||||
--- a/arch/x86/include/asm/page_32_types.h
|
||||
+++ b/arch/x86/include/asm/page_32_types.h
|
||||
@@ -20,7 +20,6 @@
|
||||
#define THREAD_SIZE_ORDER 1
|
||||
#define THREAD_SIZE (PAGE_SIZE << THREAD_SIZE_ORDER)
|
||||
|
||||
-#define STACKFAULT_STACK 0
|
||||
#define DOUBLEFAULT_STACK 1
|
||||
#define NMI_STACK 0
|
||||
#define DEBUG_STACK 0
|
||||
diff --git a/arch/x86/include/asm/page_64_types.h b/arch/x86/include/asm/page_64_types.h
|
||||
index 678205195ae1..75450b2c7be4 100644
|
||||
--- a/arch/x86/include/asm/page_64_types.h
|
||||
+++ b/arch/x86/include/asm/page_64_types.h
|
||||
@@ -14,12 +14,11 @@
|
||||
#define IRQ_STACK_ORDER 2
|
||||
#define IRQ_STACK_SIZE (PAGE_SIZE << IRQ_STACK_ORDER)
|
||||
|
||||
-#define STACKFAULT_STACK 1
|
||||
-#define DOUBLEFAULT_STACK 2
|
||||
-#define NMI_STACK 3
|
||||
-#define DEBUG_STACK 4
|
||||
-#define MCE_STACK 5
|
||||
-#define N_EXCEPTION_STACKS 5 /* hw limit: 7 */
|
||||
+#define DOUBLEFAULT_STACK 1
|
||||
+#define NMI_STACK 2
|
||||
+#define DEBUG_STACK 3
|
||||
+#define MCE_STACK 4
|
||||
+#define N_EXCEPTION_STACKS 4 /* hw limit: 7 */
|
||||
|
||||
#define PUD_PAGE_SIZE (_AC(1, UL) << PUD_SHIFT)
|
||||
#define PUD_PAGE_MASK (~(PUD_PAGE_SIZE-1))
|
||||
diff --git a/arch/x86/include/asm/traps.h b/arch/x86/include/asm/traps.h
|
||||
index bc8352e7010a..707adc6549d8 100644
|
||||
--- a/arch/x86/include/asm/traps.h
|
||||
+++ b/arch/x86/include/asm/traps.h
|
||||
@@ -39,6 +39,7 @@ asmlinkage void simd_coprocessor_error(void);
|
||||
|
||||
#ifdef CONFIG_TRACING
|
||||
asmlinkage void trace_page_fault(void);
|
||||
+#define trace_stack_segment stack_segment
|
||||
#define trace_divide_error divide_error
|
||||
#define trace_bounds bounds
|
||||
#define trace_invalid_op invalid_op
|
||||
diff --git a/arch/x86/kernel/dumpstack_64.c b/arch/x86/kernel/dumpstack_64.c
|
||||
index 1abcb50b48ae..ff86f19b5758 100644
|
||||
--- a/arch/x86/kernel/dumpstack_64.c
|
||||
+++ b/arch/x86/kernel/dumpstack_64.c
|
||||
@@ -24,7 +24,6 @@ static char x86_stack_ids[][8] = {
|
||||
[ DEBUG_STACK-1 ] = "#DB",
|
||||
[ NMI_STACK-1 ] = "NMI",
|
||||
[ DOUBLEFAULT_STACK-1 ] = "#DF",
|
||||
- [ STACKFAULT_STACK-1 ] = "#SS",
|
||||
[ MCE_STACK-1 ] = "#MC",
|
||||
#if DEBUG_STKSZ > EXCEPTION_STKSZ
|
||||
[ N_EXCEPTION_STACKS ...
|
||||
diff --git a/arch/x86/kernel/entry_64.S b/arch/x86/kernel/entry_64.S
|
||||
index 2fac1343a90b..9d9dc31a6246 100644
|
||||
--- a/arch/x86/kernel/entry_64.S
|
||||
+++ b/arch/x86/kernel/entry_64.S
|
||||
@@ -1302,7 +1302,7 @@ apicinterrupt3 HYPERVISOR_CALLBACK_VECTOR \
|
||||
|
||||
idtentry debug do_debug has_error_code=0 paranoid=1 shift_ist=DEBUG_STACK
|
||||
idtentry int3 do_int3 has_error_code=0 paranoid=1 shift_ist=DEBUG_STACK
|
||||
-idtentry stack_segment do_stack_segment has_error_code=1 paranoid=1
|
||||
+idtentry stack_segment do_stack_segment has_error_code=1
|
||||
#ifdef CONFIG_XEN
|
||||
idtentry xen_debug do_debug has_error_code=0
|
||||
idtentry xen_int3 do_int3 has_error_code=0
|
||||
diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c
|
||||
index 0d0e922fafc1..0eafe9ea2494 100644
|
||||
--- a/arch/x86/kernel/traps.c
|
||||
+++ b/arch/x86/kernel/traps.c
|
||||
@@ -233,27 +233,11 @@ DO_ERROR(X86_TRAP_UD, SIGILL, "invalid opcode", invalid_op)
|
||||
DO_ERROR(X86_TRAP_OLD_MF, SIGFPE, "coprocessor segment overrun",coprocessor_segment_overrun)
|
||||
DO_ERROR(X86_TRAP_TS, SIGSEGV, "invalid TSS", invalid_TSS)
|
||||
DO_ERROR(X86_TRAP_NP, SIGBUS, "segment not present", segment_not_present)
|
||||
-#ifdef CONFIG_X86_32
|
||||
DO_ERROR(X86_TRAP_SS, SIGBUS, "stack segment", stack_segment)
|
||||
-#endif
|
||||
DO_ERROR(X86_TRAP_AC, SIGBUS, "alignment check", alignment_check)
|
||||
|
||||
#ifdef CONFIG_X86_64
|
||||
/* Runs on IST stack */
|
||||
-dotraplinkage void do_stack_segment(struct pt_regs *regs, long error_code)
|
||||
-{
|
||||
- enum ctx_state prev_state;
|
||||
-
|
||||
- prev_state = exception_enter();
|
||||
- if (notify_die(DIE_TRAP, "stack segment", regs, error_code,
|
||||
- X86_TRAP_SS, SIGBUS) != NOTIFY_STOP) {
|
||||
- preempt_conditional_sti(regs);
|
||||
- do_trap(X86_TRAP_SS, SIGBUS, "stack segment", regs, error_code, NULL);
|
||||
- preempt_conditional_cli(regs);
|
||||
- }
|
||||
- exception_exit(prev_state);
|
||||
-}
|
||||
-
|
||||
dotraplinkage void do_double_fault(struct pt_regs *regs, long error_code)
|
||||
{
|
||||
static const char str[] = "double fault";
|
||||
@@ -778,7 +762,7 @@ void __init trap_init(void)
|
||||
set_intr_gate(X86_TRAP_OLD_MF, coprocessor_segment_overrun);
|
||||
set_intr_gate(X86_TRAP_TS, invalid_TSS);
|
||||
set_intr_gate(X86_TRAP_NP, segment_not_present);
|
||||
- set_intr_gate_ist(X86_TRAP_SS, &stack_segment, STACKFAULT_STACK);
|
||||
+ set_intr_gate(X86_TRAP_SS, stack_segment);
|
||||
set_intr_gate(X86_TRAP_GP, general_protection);
|
||||
set_intr_gate(X86_TRAP_SPURIOUS, spurious_interrupt_bug);
|
||||
set_intr_gate(X86_TRAP_MF, coprocessor_error);
|
||||
--
|
||||
1.9.3
|
||||
|
||||
Loading…
Reference in New Issue