From 4e87bc5b03e05123ba5c888f77969140c8ebd1bf Mon Sep 17 00:00:00 2001 From: Jan Beulich Date: Mon, 11 Nov 2013 09:15:04 +0100 Subject: [PATCH] nested VMX: VMLANUCH/VMRESUME emulation must check permission first thing Otherwise uninitialized data may be used, leading to crashes. This is CVE-2013-4551 / XSA-75. Reported-and-tested-by: Jeff Zimmerman Signed-off-by: Jan Beulich Reviewed-and-tested-by: Andrew Cooper Acked-by: Ian Campbell --- xen/arch/x86/hvm/vmx/vvmx.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/xen/arch/x86/hvm/vmx/vvmx.c b/xen/arch/x86/hvm/vmx/vvmx.c index 2b2de77441..26470360bf 100644 --- a/xen/arch/x86/hvm/vmx/vvmx.c +++ b/xen/arch/x86/hvm/vmx/vvmx.c @@ -1509,15 +1509,10 @@ static void clear_vvmcs_launched(struct list_head *launched_list, } } -int nvmx_vmresume(struct vcpu *v, struct cpu_user_regs *regs) +static int nvmx_vmresume(struct vcpu *v, struct cpu_user_regs *regs) { struct nestedvmx *nvmx = &vcpu_2_nvmx(v); struct nestedvcpu *nvcpu = &vcpu_nestedhvm(v); - int rc; - - rc = vmx_inst_check_privilege(regs, 0); - if ( rc != X86EMUL_OKAY ) - return rc; /* check VMCS is valid and IO BITMAP is set */ if ( (nvcpu->nv_vvmcxaddr != VMCX_EADDR) && @@ -1536,6 +1531,10 @@ int nvmx_handle_vmresume(struct cpu_user_regs *regs) struct vcpu *v = current; struct nestedvcpu *nvcpu = &vcpu_nestedhvm(v); struct nestedvmx *nvmx = &vcpu_2_nvmx(v); + int rc = vmx_inst_check_privilege(regs, 0); + + if ( rc != X86EMUL_OKAY ) + return rc; if ( vcpu_nestedhvm(v).nv_vvmcxaddr == VMCX_EADDR ) { @@ -1555,10 +1554,13 @@ int nvmx_handle_vmresume(struct cpu_user_regs *regs) int nvmx_handle_vmlaunch(struct cpu_user_regs *regs) { bool_t launched; - int rc; struct vcpu *v = current; struct nestedvcpu *nvcpu = &vcpu_nestedhvm(v); struct nestedvmx *nvmx = &vcpu_2_nvmx(v); + int rc = vmx_inst_check_privilege(regs, 0); + + if ( rc != X86EMUL_OKAY ) + return rc; if ( vcpu_nestedhvm(v).nv_vvmcxaddr == VMCX_EADDR ) { -- 2.30.2