Fix kvm nested virt CVE-2017-2596 (rhbz 1417812 1417813)
This commit is contained in:
parent
44d72048f4
commit
cd088ad843
|
@ -639,6 +639,9 @@ Patch853: drm_vc4_Fix_an_integer_overflow_in_temporary_allocation_layout.patch
|
|||
#The saddest EFI firmware bug
|
||||
Patch854: 0001-x86-efi-always-map-first-physical-page-into-EFI-page.patch
|
||||
|
||||
# CVE-2017-2596 rhbz 1417812 1417813
|
||||
Patch855: kvm-fix-page-struct-leak-in-handle_vmon.patch
|
||||
|
||||
# END OF PATCH DEFINITIONS
|
||||
|
||||
%endif
|
||||
|
@ -2186,6 +2189,9 @@ fi
|
|||
#
|
||||
#
|
||||
%changelog
|
||||
* Tue Jan 31 2017 Justin M. Forbes <jforbes@fedoraproject.org>
|
||||
- Fix kvm nested virt CVE-2017-2596 (rhbz 1417812 1417813)
|
||||
|
||||
* Tue Jan 31 2017 Peter Robinson <pbrobinson@fedoraproject.org>
|
||||
- Fix CMA compaction regression (Raspberry Pi and others)
|
||||
|
||||
|
|
|
@ -0,0 +1,50 @@
|
|||
From patchwork Tue Jan 24 10:56:21 2017
|
||||
Content-Type: text/plain; charset="utf-8"
|
||||
MIME-Version: 1.0
|
||||
Content-Transfer-Encoding: 7bit
|
||||
Subject: kvm: fix page struct leak in handle_vmon
|
||||
From: Paolo Bonzini <pbonzini@redhat.com>
|
||||
X-Patchwork-Id: 9534885
|
||||
Message-Id: <1485255381-18069-1-git-send-email-pbonzini@redhat.com>
|
||||
To: linux-kernel@vger.kernel.org, kvm@vger.kernel.org
|
||||
Cc: dvyukov@google.com
|
||||
Date: Tue, 24 Jan 2017 11:56:21 +0100
|
||||
|
||||
handle_vmon gets a reference on VMXON region page,
|
||||
but does not release it. Release the reference.
|
||||
|
||||
Found by syzkaller; based on a patch by Dmitry.
|
||||
|
||||
Reported-by: Dmitry Vyukov <dvyukov@google.com>
|
||||
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
|
||||
Reviewed-by: David Hildenbrand <david@redhat.com>
|
||||
---
|
||||
arch/x86/kvm/vmx.c | 9 +++++++--
|
||||
1 file changed, 7 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
|
||||
index 42cc3d6f4d20..0f7345035210 100644
|
||||
--- a/arch/x86/kvm/vmx.c
|
||||
+++ b/arch/x86/kvm/vmx.c
|
||||
@@ -7085,13 +7085,18 @@ static int nested_vmx_check_vmptr(struct kvm_vcpu *vcpu, int exit_reason,
|
||||
}
|
||||
|
||||
page = nested_get_page(vcpu, vmptr);
|
||||
- if (page == NULL ||
|
||||
- *(u32 *)kmap(page) != VMCS12_REVISION) {
|
||||
+ if (page == NULL) {
|
||||
nested_vmx_failInvalid(vcpu);
|
||||
+ return kvm_skip_emulated_instruction(vcpu);
|
||||
+ }
|
||||
+ if (*(u32 *)kmap(page) != VMCS12_REVISION) {
|
||||
kunmap(page);
|
||||
+ nested_release_page_clean(page);
|
||||
+ nested_vmx_failInvalid(vcpu);
|
||||
skip_emulated_instruction(vcpu);
|
||||
return 1;
|
||||
}
|
||||
kunmap(page);
|
||||
+ nested_release_page_clean(page);
|
||||
vmx->nested.vmxon_ptr = vmptr;
|
||||
break;
|
||||
case EXIT_REASON_VMCLEAR:
|
Loading…
Reference in New Issue