lkml.org 
[lkml]   [2020]   [Feb]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.14 079/173] KVM: x86: Refactor prefix decoding to prevent Spectre-v1/L1TF attacks
    Date
    From: Marios Pomonis <pomonis@google.com>

    commit 125ffc5e0a56a3eded608dc51e09d5ebf72cf652 upstream.

    This fixes Spectre-v1/L1TF vulnerabilities in
    vmx_read_guest_seg_selector(), vmx_read_guest_seg_base(),
    vmx_read_guest_seg_limit() and vmx_read_guest_seg_ar(). When
    invoked from emulation, these functions contain index computations
    based on the (attacker-influenced) segment value. Using constants
    prevents the attack.

    Cc: stable@vger.kernel.org
    Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    arch/x86/kvm/emulate.c | 16 ++++++++++++++--
    1 file changed, 14 insertions(+), 2 deletions(-)

    --- a/arch/x86/kvm/emulate.c
    +++ b/arch/x86/kvm/emulate.c
    @@ -5094,16 +5094,28 @@ int x86_decode_insn(struct x86_emulate_c
    ctxt->ad_bytes = def_ad_bytes ^ 6;
    break;
    case 0x26: /* ES override */
    + has_seg_override = true;
    + ctxt->seg_override = VCPU_SREG_ES;
    + break;
    case 0x2e: /* CS override */
    + has_seg_override = true;
    + ctxt->seg_override = VCPU_SREG_CS;
    + break;
    case 0x36: /* SS override */
    + has_seg_override = true;
    + ctxt->seg_override = VCPU_SREG_SS;
    + break;
    case 0x3e: /* DS override */
    has_seg_override = true;
    - ctxt->seg_override = (ctxt->b >> 3) & 3;
    + ctxt->seg_override = VCPU_SREG_DS;
    break;
    case 0x64: /* FS override */
    + has_seg_override = true;
    + ctxt->seg_override = VCPU_SREG_FS;
    + break;
    case 0x65: /* GS override */
    has_seg_override = true;
    - ctxt->seg_override = ctxt->b & 7;
    + ctxt->seg_override = VCPU_SREG_GS;
    break;
    case 0x40 ... 0x4f: /* REX */
    if (mode != X86EMUL_MODE_PROT64)

    \
     
     \ /
      Last update: 2020-02-13 16:58    [W:2.627 / U:0.972 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site