From 5c447caaf49192c7b2c057ffbb565ce72aac666d Mon Sep 17 00:00:00 2001 From: Jan Beulich Date: Wed, 27 Nov 2013 09:01:49 +0100 Subject: [PATCH] x86/HVM: only allow ring 0 guest code to make hypercalls Anything else would allow for privilege escalation. This is CVE-2013-4554 / XSA-76. Signed-off-by: Jan Beulich Acked-by: Ian Campbell --- xen/arch/x86/hvm/hvm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/xen/arch/x86/hvm/hvm.c b/xen/arch/x86/hvm/hvm.c index af249f7543..e2ba9ded0c 100644 --- a/xen/arch/x86/hvm/hvm.c +++ b/xen/arch/x86/hvm/hvm.c @@ -3468,7 +3468,7 @@ int hvm_do_hypercall(struct cpu_user_regs *regs) case 4: case 2: hvm_get_segment_register(curr, x86_seg_ss, &sreg); - if ( unlikely(sreg.attr.fields.dpl == 3) ) + if ( unlikely(sreg.attr.fields.dpl) ) { default: regs->eax = -EPERM; -- 2.30.2