From: Jan Beulich Date: Wed, 1 Oct 2014 12:54:47 +0000 (+0200) Subject: x86/HVM: properly bound x2APIC MSR range X-Git-Tag: archive/raspbian/4.8.0-1+rpi1~1^2~4287 X-Git-Url: https://dgit.raspbian.org/%22http://www.example.com/cgi/%22/%22http:/www.example.com/cgi/%22?a=commitdiff_plain;h=61fdda7ac;p=xen.git x86/HVM: properly bound x2APIC MSR range While the write path change appears to be purely cosmetic (but still gets done here for consistency), the read side mistake permitted accesses beyond the virtual APIC page. Note that while this isn't fully in line with the specification (digesting MSRs 0x800-0xBFF for the x2APIC), this is the minimal possible fix addressing the security issue and getting x2APIC related code into a consistent shape (elsewhere a 256 rather than 1024 wide window is being used too). This will be dealt with subsequently. This is CVE-2014-7188 / XSA-108. Signed-off-by: Jan Beulich --- diff --git a/xen/arch/x86/hvm/hvm.c b/xen/arch/x86/hvm/hvm.c index 43471de71d..681ae5ca29 100644 --- a/xen/arch/x86/hvm/hvm.c +++ b/xen/arch/x86/hvm/hvm.c @@ -4355,7 +4355,7 @@ int hvm_msr_read_intercept(unsigned int msr, uint64_t *msr_content) *msr_content = vcpu_vlapic(v)->hw.apic_base_msr; break; - case MSR_IA32_APICBASE_MSR ... MSR_IA32_APICBASE_MSR + 0x3ff: + case MSR_IA32_APICBASE_MSR ... MSR_IA32_APICBASE_MSR + 0xff: if ( hvm_x2apic_msr_read(v, msr, msr_content) ) goto gp_fault; break; @@ -4482,7 +4482,7 @@ int hvm_msr_write_intercept(unsigned int msr, uint64_t msr_content) vlapic_tdt_msr_set(vcpu_vlapic(v), msr_content); break; - case MSR_IA32_APICBASE_MSR ... MSR_IA32_APICBASE_MSR + 0x3ff: + case MSR_IA32_APICBASE_MSR ... MSR_IA32_APICBASE_MSR + 0xff: if ( hvm_x2apic_msr_write(v, msr, msr_content) ) goto gp_fault; break;