From c844d637d92a75854ea5c8d4e5ca34302a9f623c Mon Sep 17 00:00:00 2001 From: Jan Beulich Date: Thu, 8 Sep 2016 14:14:53 +0200 Subject: [PATCH] x86/32on64: don't allow recursive page tables from L3 MIME-Version: 1.0 Content-Type: text/plain; charset=utf8 Content-Transfer-Encoding: 8bit L3 entries are special in PAE mode, and hence can't reasonably be used for setting up recursive (and hence linear) page table mappings. Since abuse is possible when the guest in fact gets run on 4-level page tables, this needs to be excluded explicitly. This is XSA-185 / CVE-2016-7092. Reported-by: Jérémie Boutoille Reported-by: "栾尚聪(好风)" Signed-off-by: Jan Beulich Reviewed-by: Andrew Cooper --- xen/arch/x86/mm.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/xen/arch/x86/mm.c b/xen/arch/x86/mm.c index 670998f774..b9debcca0b 100644 --- a/xen/arch/x86/mm.c +++ b/xen/arch/x86/mm.c @@ -1124,7 +1124,9 @@ get_page_from_l3e( rc = get_page_and_type_from_pagenr( l3e_get_pfn(l3e), PGT_l2_page_table, d, partial, 1); - if ( unlikely(rc == -EINVAL) && get_l3_linear_pagetable(l3e, pfn, d) ) + if ( unlikely(rc == -EINVAL) && + !is_pv_32bit_domain(d) && + get_l3_linear_pagetable(l3e, pfn, d) ) rc = 0; return rc; -- 2.30.2