lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-Id: <1399992941-11600-1-git-send-email-pbonzini@redhat.com>
Date:	Tue, 13 May 2014 16:55:36 +0200
From:	Paolo Bonzini <pbonzini@...hat.com>
To:	linux-kernel@...r.kernel.org
Cc:	jan.kiszka@...mens.com, kvm@...r.kernel.org, gleb@...nel.org,
	avi.kivity@...il.com
Subject: [PATCH 0/5] KVM: x86: support setting the CPL independent of CS

Until now, KVM used to assume that CS.RPL could always be used as the CPL
value when KVM_SET_SREGS is called.  Unfortunately this is not the case.
If userspace decides to call KVM_GET_SREGS/KVM_SET_SREGS exactly after
CR0.PE has been set to 1, but before the long jump that reloads CS, the
CPL will be reset to bits 0-1 of CS (aka CS.RPL).  This can work or not,
depending on the placement of the code that transitions to protected
mode.  If CS.RPL != 0 the emulator will see CS.RPL != CS.DPL (the DPL
will always be zero) and fail to fetch the next instruction of the
transition code.

The same bug exists with SVM, where you don't have the emulator but the
guest will triple fault.  Strangely, it doesn't occur with Intel's
unrestricted guest mode.

To trigger this using QEMU, it is enough to send "info cpus" continuously
while running iPXE (which places its code for real->protected mode in
the EBDA).  iPXE does a lot of transitions, and the guest will crash
very quickly.

Avi or Gleb, this is a bit tricky.  Can you review it please?

Paolo Bonzini (5):
  KVM: x86: support KVM_ENABLE_CAP on vm file descriptors
  KVM: x86: get CPL in KVM_GET_SREGS, prepare to be able to set it
  KVM: vmx: always compute the CPL on KVM_SET_SREGS
  KVM: vmx: force CPL=0 on real->protected mode transition
  KVM: x86: add capability to get/set CPL

 arch/x86/include/asm/kvm_host.h |  4 ++-
 arch/x86/include/uapi/asm/kvm.h |  5 +++-
 arch/x86/kvm/svm.c              | 13 +++++++--
 arch/x86/kvm/vmx.c              | 62 ++++++++++++++++++++++++++---------------
 arch/x86/kvm/x86.c              | 53 +++++++++++++++++++++++++++--------
 include/uapi/linux/kvm.h        |  1 +
 6 files changed, 98 insertions(+), 40 deletions(-)

-- 
1.8.3.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ