Sign Up
Log In
Log In
or
Sign Up
Places
All Projects
Status Monitor
Collapse sidebar
SUSE:SLE-12-SP1:Update
xen.3680
56fa73fa-x86-fix-information-leak-on-AMD-CPUs.p...
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File 56fa73fa-x86-fix-information-leak-on-AMD-CPUs.patch of Package xen.3680
References: bsc#973188 CVE-2016-3159 XSA-172 # Commit 7bd9dc3adfbb014c55f0928ebb3b20950ca9c019 # Date 2016-03-29 14:24:26 +0200 # Author Jan Beulich <jbeulich@suse.com> # Committer Jan Beulich <jbeulich@suse.com> x86: fix information leak on AMD CPUs The fix for XSA-52 was wrong, and so was the change synchronizing that new behavior to the FXRSTOR logic: AMD's manuals explictly state that writes to the ES bit are ignored, and it instead gets calculated from the exception and mask bits (it gets set whenever there is an unmasked exception, and cleared otherwise). Hence we need to follow that model in our workaround. This is CVE-2016-3158 / CVE-2016-3159 / XSA-172. [xen/arch/x86/xstate.c:xrstor: CVE-2016-3158] [xen/arch/x86/i387.c:fpu_fxrstor: CVE-2016-3159] Signed-off-by: Jan Beulich <jbeulich@suse.com> Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com> --- a/xen/arch/x86/i387.c +++ b/xen/arch/x86/i387.c @@ -49,7 +49,7 @@ static inline void fpu_fxrstor(struct vc * sometimes new user value. Both should be ok. Use the FPU saved * data block as a safe address because it should be in L1. */ - if ( !(fpu_ctxt->fsw & 0x0080) && + if ( !(fpu_ctxt->fsw & ~fpu_ctxt->fcw & 0x003f) && boot_cpu_data.x86_vendor == X86_VENDOR_AMD ) { asm volatile ( "fnclex\n\t" --- a/xen/arch/x86/xstate.c +++ b/xen/arch/x86/xstate.c @@ -163,7 +163,7 @@ void xrstor(struct vcpu *v, uint64_t mas * data block as a safe address because it should be in L1. */ if ( (mask & ptr->xsave_hdr.xstate_bv & XSTATE_FP) && - !(ptr->fpu_sse.fsw & 0x0080) && + !(ptr->fpu_sse.fsw & ~ptr->fpu_sse.fcw & 0x003f) && boot_cpu_data.x86_vendor == X86_VENDOR_AMD ) asm volatile ( "fnclex\n\t" /* clear exceptions */ "ffree %%st(7)\n\t" /* clear stack tag */
Locations
Projects
Search
Status Monitor
Help
OpenBuildService.org
Documentation
API Documentation
Code of Conduct
Contact
Support
@OBShq
Terms
openSUSE Build Service is sponsored by
The Open Build Service is an
openSUSE project
.
Sign Up
Log In
Places
Places
All Projects
Status Monitor