lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date:   Thu, 26 Oct 2017 15:45:45 +0200
From:   Paolo Bonzini <pbonzini@...hat.com>
To:     linux-kernel@...r.kernel.org, kvm@...r.kernel.org
Cc:     Christoffer Dall <christoffer.dall@...aro.org>,
        Marc Zyngier <marc.zyngier@....com>,
        Christian Borntraeger <borntraeger@...ibm.com>,
        Cornelia Huck <cohuck@...hat.com>,
        James Hogan <james.hogan@...tec.com>,
        Paul Mackerras <paulus@...ba.org>,
        kernel-hardening@...ts.openwall.com,
        Kees Cook <keescook@...omium.org>,
        Radim Krčmář <rkrcmar@...hat.com>
Subject: [PATCH v2 0/2] KVM: fixes for the kernel-hardening tree

Four KVM ioctls (KVM_GET/SET_CPUID2 on x86, KVM_GET/SET_ONE_REG on
ARM and s390) directly access the kvm_vcpu_arch struct.  Therefore, the
new usercopy hardening work in linux-next, which forbids copies from and
to slab objects unless they are from kmalloc or explicitly whitelisted,
breaks KVM on those architectures.

The kvm_vcpu_arch struct is embedded in the kvm_vcpu struct and the
corresponding slab cache is allocated by architecture-independent code.
It is enough, for simplicity, to whitelist the whole sub-struct and
only touch one place of the KVM code.  Later, any further restrictions
can be applied in the KVM tree.

Paolo Bonzini (2):
  kvm: whitelist struct kvm_vcpu_arch
  kvm: x86: fix KVM_XEN_HVM_CONFIG ioctl

 arch/x86/kvm/x86.c  | 7 ++++---
 virt/kvm/kvm_main.c | 8 ++++++--
 2 files changed, 10 insertions(+), 5 deletions(-)

-- 
2.14.2

Powered by blists - more mailing lists