Sign Up
Log In
Log In
or
Sign Up
Places
All Projects
Status Monitor
Collapse sidebar
SUSE:SLE-12-SP4:GA
xen.3242
57976078-x86-avoid-SMAP-violation-in-compat_cre...
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File 57976078-x86-avoid-SMAP-violation-in-compat_create_bounce_frame.patch of Package xen.3242
References: bsc#988676 CVE-2016-6259 XSA-183 # Commit 9f1441487aa215193a7c00fd9cb80b335542465e # Date 2016-07-26 14:07:04 +0100 # Author Andrew Cooper <andrew.cooper3@citrix.com> # Committer Andrew Cooper <andrew.cooper3@citrix.com> x86/entry: Avoid SMAP violation in compat_create_bounce_frame() A 32bit guest kernel might be running on user mappings. compat_create_bounce_frame() must whitelist its guest accesses to avoid risking a SMAP violation. For both variants of create_bounce_frame(), re-blacklist user accesses if execution exits via an exception table redirection. This is XSA-183 / CVE-2016-6259 Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com> Reviewed-by: George Dunlap <george.dunlap@citrix.com> Reviewed-by: Jan Beulich <jbeulich@suse.com> --- a/xen/arch/x86/x86_64/compat/entry.S +++ b/xen/arch/x86/x86_64/compat/entry.S @@ -337,6 +337,7 @@ ENTRY(compat_int80_direct_trap) compat_create_bounce_frame: ASSERT_INTERRUPTS_ENABLED mov %fs,%edi + ASM_STAC testb $2,UREGS_cs+8(%rsp) jz 1f /* Push new frame at registered guest-OS stack base. */ @@ -390,6 +391,7 @@ UNLIKELY_START(nz, compat_bounce_failsaf movl %ds,%eax .Lft12: movl %eax,%fs:0*4(%rsi) # DS UNLIKELY_END(compat_bounce_failsafe) + ASM_CLAC /* Rewrite our stack frame and return to guest-OS mode. */ /* IA32 Ref. Vol. 3: TF, VM, RF and NT flags are cleared on trap. */ andl $~(X86_EFLAGS_VM|X86_EFLAGS_RF|\ @@ -435,6 +437,7 @@ compat_crash_page_fault_4: addl $4,%esi compat_crash_page_fault: .Lft14: mov %edi,%fs + ASM_CLAC movl %esi,%edi call show_page_walk jmp dom_crash_sync_extable --- a/xen/arch/x86/x86_64/entry.S +++ b/xen/arch/x86/x86_64/entry.S @@ -464,9 +464,11 @@ domain_crash_page_fault_16: domain_crash_page_fault_8: addq $8,%rsi domain_crash_page_fault: + ASM_CLAC movq %rsi,%rdi call show_page_walk ENTRY(dom_crash_sync_extable) + ASM_CLAC # Get out of the guest-save area of the stack. GET_STACK_BASE(%rax) leaq STACK_CPUINFO_FIELD(guest_cpu_user_regs)(%rax),%rsp
Locations
Projects
Search
Status Monitor
Help
OpenBuildService.org
Documentation
API Documentation
Code of Conduct
Contact
Support
@OBShq
Terms
openSUSE Build Service is sponsored by
The Open Build Service is an
openSUSE project
.
Sign Up
Log In
Places
Places
All Projects
Status Monitor