linux-kernel - Re: [PATCH v2] KVM: s390: Do not leak kernel stack data in the KVM_S390

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <3ad774f9-1cf3-b73e-576e-df6416484f9f@linux.ibm.com>
Date:   Thu, 12 Sep 2019 14:07:37 +0200
From:   Janosch Frank <frankja@...ux.ibm.com>
To:     Thomas Huth <thuth@...hat.com>,
        Christian Borntraeger <borntraeger@...ibm.com>,
        kvm@...r.kernel.org
Cc:     David Hildenbrand <david@...hat.com>,
        Cornelia Huck <cohuck@...hat.com>, linux-s390@...r.kernel.org,
        linux-kernel@...r.kernel.org, stable@...r.kernel.org
Subject: Re: [PATCH v2] KVM: s390: Do not leak kernel stack data in the
 KVM_S390_INTERRUPT ioctl

On 9/12/19 1:54 PM, Thomas Huth wrote:
> When the userspace program runs the KVM_S390_INTERRUPT ioctl to inject
> an interrupt, we convert them from the legacy struct kvm_s390_interrupt
> to the new struct kvm_s390_irq via the s390int_to_s390irq() function.
> However, this function does not take care of all types of interrupts
> that we can inject into the guest later (see do_inject_vcpu()). Since we
> do not clear out the s390irq values before calling s390int_to_s390irq(),
> there is a chance that we copy random data from the kernel stack which
> could be leaked to the userspace later.
> 
> Specifically, the problem exists with the KVM_S390_INT_PFAULT_INIT
> interrupt: s390int_to_s390irq() does not handle it, and the function
> __inject_pfault_init() later copies irq->u.ext which contains the
> random kernel stack data. This data can then be leaked either to
> the guest memory in __deliver_pfault_init(), or the userspace might
> retrieve it directly with the KVM_S390_GET_IRQ_STATE ioctl.
> 
> Fix it by handling that interrupt type in s390int_to_s390irq(), too,
> and by making sure that the s390irq struct is properly pre-initialized.
> And while we're at it, make sure that s390int_to_s390irq() now
> directly returns -EINVAL for unknown interrupt types, so that we
> immediately get a proper error code in case we add more interrupt
> types to do_inject_vcpu() without updating s390int_to_s390irq()
> sometime in the future.
> 
> Cc: stable@...r.kernel.org
> Reviewed-by: David Hildenbrand <david@...hat.com>
> Reviewed-by: Christian Borntraeger <borntraeger@...ibm.com>
> Signed-off-by: Thomas Huth <thuth@...hat.com>

Reviewed-by: Janosch Frank <frankja@...ux.ibm.com>



Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)