linux-kernel - [PATCH 0/2] KVM: X86/MMU: Fix problem for shadowing 5-level NPT for 4-level NPT L1 guest

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 20 Apr 2022 21:12:02 +0800
From:   Lai Jiangshan <jiangshanlai@...il.com>
To:     linux-kernel@...r.kernel.org, kvm@...r.kernel.org,
        Paolo Bonzini <pbonzini@...hat.com>,
        Sean Christopherson <seanjc@...gle.com>
Cc:     Lai Jiangshan <jiangshan.ljs@...group.com>
Subject: [PATCH 0/2] KVM: X86/MMU: Fix problem for shadowing 5-level NPT for 4-level NPT L1 guest

From: Lai Jiangshan <jiangshan.ljs@...group.com>

When shadowing 5-level NPT for 4-level NPT L1 guest, the root_sp is
allocated with role.level = 5 and the guest pagetable's root gfn.

And root_sp->spt[0] is also allocated with the same gfn and the same
role except role.level = 4.  Luckily that they are different shadow
pages, but only root_sp->spt[0] is the real translation of the guest
pagetable.

Here comes a problem:

If the guest switches from gCR4_LA57=0 to gCR4_LA57=1 (or vice verse)
and uses the same gfn as the root page for nested NPT before and after
switching gCR4_LA57.  The host (hCR4_LA57=1) might use the same root_sp
for the guest even the guest switches gCR4_LA57.  The guest will see
unexpected page mapped and L2 may exploit the bug and hurt L1.  It is
lucky that the problem can't hurt L0.

Fix it by introducing role.passthrough.

Lai Jiangshan (2):
  KVM: X86/MMU: Add sp_has_gptes()
  KVM: X86/MMU: Introduce role.passthrough for shadowing 5-level NPT for
    4-level NPT L1 guest

 Documentation/virt/kvm/mmu.rst  |  3 +++
 arch/x86/include/asm/kvm_host.h |  5 +++--
 arch/x86/kvm/mmu/mmu.c          | 38 +++++++++++++++++++++++++++------
 arch/x86/kvm/mmu/paging_tmpl.h  |  1 +
 4 files changed, 38 insertions(+), 9 deletions(-)

-- 
2.19.1.6.gb485710b