From 6260f827cb90bd792ad17e377b8df65adad471ec Mon Sep 17 00:00:00 2001 From: "Justin M. Forbes" Date: Thu, 15 Dec 2016 08:38:59 -0600 Subject: [PATCH] CVE-2016-9588 fix possible DoS in nVMX (rhbz 1404924 1404925) --- kernel.spec | 7 ++ ...-L1-to-intercept-software-exceptions.patch | 68 +++++++++++++++++++ 2 files changed, 75 insertions(+) create mode 100644 kvm-nVMX-allow-L1-to-intercept-software-exceptions.patch diff --git a/kernel.spec b/kernel.spec index ed6734d89..945f529e2 100644 --- a/kernel.spec +++ b/kernel.spec @@ -637,6 +637,9 @@ Patch854: nouveau-add-maxwell-to-backlight-init.patch # CVE-2016-9755 rhbz 1400904 1400905 Patch856: 0001-netfilter-ipv6-nf_defrag-drop-mangled-skb-on-ream-er.patch +# CVE-2016-9588 rhbz 1404924 1404925 +Patch857: kvm-nVMX-allow-L1-to-intercept-software-exceptions.patch + # END OF PATCH DEFINITIONS %endif @@ -2159,6 +2162,10 @@ fi # # %changelog +* Thu Dec 15 2016 Justin M. Forbes +- CVE-2016-9588 fix possible DoS in nVMX (rhbz 1404924 1404925) +- Turn off CONFIG_IWLWIFI_PCIE_RTPM as it can cause wifi disconnects + * Mon Dec 12 2016 Justin M. Forbes - 4.8.14-100 - Linux v4.8.14 - CVE-2016-8399 Fix out OOB stack read in memcpy_fromiovec (rhbz 1403833 1403834) diff --git a/kvm-nVMX-allow-L1-to-intercept-software-exceptions.patch b/kvm-nVMX-allow-L1-to-intercept-software-exceptions.patch new file mode 100644 index 000000000..b408fc604 --- /dev/null +++ b/kvm-nVMX-allow-L1-to-intercept-software-exceptions.patch @@ -0,0 +1,68 @@ +From: Jim Mattson +To: kvm@vger.kernel.org +Cc: Jim Mattson +Subject: [PATCH] kvm: nVMX: Allow L1 to intercept software exceptions (#BP and #OF) +Date: Wed, 14 Dec 2016 11:41:59 -0800 + +When L2 exits to L0 due to "exception or NMI", software exceptions +(#BP and #OF) for which L1 has requested an intercept should be +handled by L1 rather than L0. Previously, only hardware exceptions +were forwarded to L1. + +Signed-off-by: Jim Mattson +--- + arch/x86/kvm/vmx.c | 11 +++++------ + 1 file changed, 5 insertions(+), 6 deletions(-) + +diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c +index 5382b82..64774f4 100644 +--- a/arch/x86/kvm/vmx.c ++++ b/arch/x86/kvm/vmx.c +@@ -1343,10 +1343,10 @@ static inline bool nested_cpu_has_posted_intr(struct vmcs12 *vmcs12) + return vmcs12->pin_based_vm_exec_control & PIN_BASED_POSTED_INTR; + } + +-static inline bool is_exception(u32 intr_info) ++static inline bool is_nmi(u32 intr_info) + { + return (intr_info & (INTR_INFO_INTR_TYPE_MASK | INTR_INFO_VALID_MASK)) +- == (INTR_TYPE_HARD_EXCEPTION | INTR_INFO_VALID_MASK); ++ == (INTR_TYPE_NMI_INTR | INTR_INFO_VALID_MASK); + } + + static void nested_vmx_vmexit(struct kvm_vcpu *vcpu, u32 exit_reason, +@@ -5476,7 +5476,7 @@ static int handle_exception(struct kvm_vcpu *vcpu) + if (is_machine_check(intr_info)) + return handle_machine_check(vcpu); + +- if ((intr_info & INTR_INFO_INTR_TYPE_MASK) == INTR_TYPE_NMI_INTR) ++ if (is_nmi(intr_info)) + return 1; /* already handled by vmx_vcpu_run() */ + + if (is_no_device(intr_info)) { +@@ -8018,7 +8018,7 @@ static bool nested_vmx_exit_handled(struct kvm_vcpu *vcpu) + + switch (exit_reason) { + case EXIT_REASON_EXCEPTION_NMI: +- if (!is_exception(intr_info)) ++ if (is_nmi(intr_info)) + return false; + else if (is_page_fault(intr_info)) + return enable_ept; +@@ -8611,8 +8611,7 @@ static void vmx_complete_atomic_exit(struct vcpu_vmx *vmx) + kvm_machine_check(); + + /* We need to handle NMIs before interrupts are enabled */ +- if ((exit_intr_info & INTR_INFO_INTR_TYPE_MASK) == INTR_TYPE_NMI_INTR && +- (exit_intr_info & INTR_INFO_VALID_MASK)) { ++ if (is_nmi(exit_intr_info)) { + kvm_before_handle_nmi(&vmx->vcpu); + asm("int $2"); + kvm_after_handle_nmi(&vmx->vcpu); +-- +2.8.0.rc3.226.g39d4020 + +-- +To unsubscribe from this list: send the line "unsubscribe kvm" in +the body of a message to majordomo@vger.kernel.org +More majordomo info at http://vger.kernel.org/majordomo-info.html