x86/sev: Check for user-space IOIO pointing to kernel space

Browse source

Check the memory operand of INS/OUTS before emulating the instruction.
The #VC exception can get raised from user-space, but the memory operand
can be manipulated to access kernel memory before the emulation actually
begins and after the exception handler has run.

  [ bp: Massage commit message. ]

Fixes: 597cfe4821 ("x86/boot/compressed/64: Setup a GHCB-based VC Exception handler")
Reported-by: Tom Dohrmann <erbse.13@gmx.de>
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Cc: <stable@kernel.org>

...

This commit is contained in:

Joerg Roedel 2023-10-16 14:42:50 +02:00 • committed by Borislav Petkov (AMD)

parent b9cb9c4558

commit 63e44bc520

2 changed files with 34 additions and 2 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

5

arch/x86/boot/compressed/sev.c

View file

31

arch/x86/kernel/sev-shared.c

View file