From 346d4545569928b652c40c7815c1732676f8587c Mon Sep 17 00:00:00 2001 From: Jan Beulich Date: Tue, 23 Sep 2014 14:33:50 +0200 Subject: [PATCH] x86emul: only emulate software interrupt injection for real mode Protected mode emulation currently lacks proper privilege checking of the referenced IDT entry, and there's currently no legitimate way for any of the respective instructions to reach the emulator when the guest is in protected mode. This is XSA-106. Reported-by: Andrei LUTAS Signed-off-by: Jan Beulich Acked-by: Keir Fraser --- xen/arch/x86/x86_emulate/x86_emulate.c | 1 + 1 file changed, 1 insertion(+) diff --git a/xen/arch/x86/x86_emulate/x86_emulate.c b/xen/arch/x86/x86_emulate/x86_emulate.c index 4810e6877c..5fbe0243fe 100644 --- a/xen/arch/x86/x86_emulate/x86_emulate.c +++ b/xen/arch/x86/x86_emulate/x86_emulate.c @@ -2634,6 +2634,7 @@ x86_emulate( case 0xcd: /* int imm8 */ src.val = insn_fetch_type(uint8_t); swint: + fail_if(!in_realmode(ctxt, ops)); /* XSA-106 */ fail_if(ops->inject_sw_interrupt == NULL); rc = ops->inject_sw_interrupt(src.val, _regs.eip - ctxt->regs->eip, ctxt) ? : X86EMUL_EXCEPTION; -- 2.30.2