From 365c95f7de789e1dca03f119eab7dc61fe0f77c9 Mon Sep 17 00:00:00 2001 From: Jan Beulich Date: Tue, 4 Jun 2013 09:29:07 +0200 Subject: [PATCH] x86/xsave: properly check guest input to XSETBV Other than the HVM emulation path, the PV case so far failed to check that YMM state requires SSE state to be enabled, allowing for a #GP to occur upon passing the inputs to XSETBV inside the hypervisor. This is CVE-2013-2078 / XSA-54. Signed-off-by: Jan Beulich --- xen/arch/x86/traps.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/xen/arch/x86/traps.c b/xen/arch/x86/traps.c index 087bbebf5f..ef964c3e39 100644 --- a/xen/arch/x86/traps.c +++ b/xen/arch/x86/traps.c @@ -2205,6 +2205,11 @@ static int emulate_privileged_op(struct cpu_user_regs *regs) if ( !(new_xfeature & XSTATE_FP) || (new_xfeature & ~xfeature_mask) ) goto fail; + /* YMM state takes SSE state as prerequisite. */ + if ( (xfeature_mask & new_xfeature & XSTATE_YMM) && + !(new_xfeature & XSTATE_SSE) ) + goto fail; + v->arch.xcr0 = new_xfeature; v->arch.xcr0_accum |= new_xfeature; set_xcr0(new_xfeature); -- 2.30.2