kvm: x86: use correct privilege level for sgdt/sidt/fxsave/fxrstor access

Browse source

commit 3c9fa24ca7 upstream.

The functions that were used in the emulation of fxrstor, fxsave, sgdt and
sidt were originally meant for task switching, and as such they did not
check privilege levels.  This is very bad when the same functions are used
in the emulation of unprivileged instructions.  This is CVE-2018-10853.

The obvious fix is to add a new argument to ops->read_std and ops->write_std,
which decides whether the access is a "system" access or should use the
processor's CPL.

Fixes: 129a72a0d3 ("KVM: x86: Introduce segmented_write_std", 2017-01-12)
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
[bwh: Backported to 3.16: Drop change in handle_ud()]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>

...

This commit is contained in:

Paolo Bonzini 2018-06-06 17:38:09 +02:00 • committed by Ben Hutchings

parent b1632afd23

commit c1eef5daec

3 changed files with 24 additions and 12 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

6

arch/x86/include/asm/kvm_emulate.h

View file

12

arch/x86/kvm/emulate.c

View file

18

arch/x86/kvm/x86.c

View file