linux-kernel - Re: KVM guest-kernel panics double fault

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 29 Dec 2011 12:04:07 +0200
From:	Avi Kivity <avi@...hat.com>
To:	Stephan Bärwolf <stephan.baerwolf@...ilmenau.de>
CC:	linux-kernel@...r.kernel.org,
	Linus Torvalds <torvalds@...ux-foundation.org>
Subject: Re: KVM guest-kernel panics double fault

On 12/29/2011 03:59 AM, Stephan Bärwolf wrote:
> Hello guys,
>
> I am sorry to disturb you this short before New Year, but I think this
> shouldn't wait until next year.
>
> After experiencing crashes in virtual maschines and considering kernel /
> qemu / kvm / cpu -bugs, I discovered the following (see patch) issue.
> Because unpriviledged users can crash VMs, I think it is a serious one
> and needs short-term attention.
>
> The patch I wrote is against 3.2-rc7 but I always tested with linux 3.1.6.
> Hopfully it solve the problems to your satisfaction.


Thanks for the report and patch.


> Subject: [PATCH] KVM: fix missing "illegal instruction"-trap in guests
> within non-64bit protected modes
>
> On hosts without this patch, 32bit guests will crash for
> example by simply executing following nasm-demo-application:
>
>         [bits 32]
>         global _start
>         SECTION .text
>         _start: syscall
>
> (I am not sure if this can be exploited in more worse ways,
> like breaking out of VMs in more complex szenarios?
> But I tested it with win32 and linux - both always crashed)
>
>         Disassembly of section .text:
>
>         00000000 <_start>:
>            0:   0f 05                   syscall
>
> The reason seems a missing "invalid opcode"-trap (int6) for the
> syscall opcode "0f05", which is not available on 32bit cpus.
> Intel's "Intel 64 and IA-32 Architecture Software Developers
> Manual" (http://www.intel.com/content/dam/doc/manual/
> 64-ia-32-architectures-software-developer-manual-325462.pdf)
> documents on page 1804 (4-586) "syscall" is only available
> in 64bit longmode. So "syscall" must trap in real- and
> virtual 8086 -mode, as also in all non-64bit protected-modes.

However, 'syscall' is available in compatibility mode on 32-bit cpus.

> 0001-KVM-fix-missing-illegal-instruction-trap-in-guests-w.patch
>  	/* syscall is not available in real mode */
> +	/* 
> +	   "0f05" is also not available in
> +	   all non-64-bit protected modes (16&
> +	   32bit) or virtual 8086 mode		 
> +	   Only 64bit longmode supports this opcode
> +	*/
>  	if (ctxt->mode == X86EMUL_MODE_REAL ||
> +	    ctxt->mode == X86EMUL_MODE_PROT16 ||
> +	    ctxt->mode == X86EMUL_MODE_PROT32 ||
>  	    ctxt->mode == X86EMUL_MODE_VM86)
>  		return emulate_ud(ctxt);
>  
>

The PROT32 check should be qualifed by a checking the the guest cpuid
vendor is not AMD.  Otherwise a guest that was migrated from an AMD host
to an Intel host (this is what this emulation was written for in the
first place) will #UD unexpectedly.

-- 
error compiling committee.c: too many arguments to function

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/