File 542168ae-x86emul-only-emulate-swint-injection-f... of Package xen.196

Overview Repositories Revisions Requests Users Attributes Meta

File 542168ae-x86emul-only-emulate-swint-injection-for-real-mode.patch of Package xen.196

References: bnc#895802 CVE-2014-7156 XSA-106

# Commit 346d4545569928b652c40c7815c1732676f8587c
# Date 2014-09-23 14:33:50 +0200
# Author Jan Beulich <jbeulich@suse.com>
# Committer Jan Beulich <jbeulich@suse.com>
x86emul: only emulate software interrupt injection for real mode

Protected mode emulation currently lacks proper privilege checking of
the referenced IDT entry, and there's currently no legitimate way for
any of the respective instructions to reach the emulator when the guest
is in protected mode.

This is XSA-106.

Reported-by: Andrei LUTAS <vlutas@bitdefender.com>
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Keir Fraser <keir@xen.org>

--- a/xen/arch/x86/x86_emulate/x86_emulate.c
+++ b/xen/arch/x86/x86_emulate/x86_emulate.c
@@ -2634,6 +2634,7 @@ x86_emulate(
     case 0xcd: /* int imm8 */
         src.val = insn_fetch_type(uint8_t);
     swint:
+        fail_if(!in_realmode(ctxt, ops)); /* XSA-106 */
         fail_if(ops->inject_sw_interrupt == NULL);
         rc = ops->inject_sw_interrupt(src.val, _regs.eip - ctxt->regs->eip,
                                       ctxt) ? : X86EMUL_EXCEPTION;

Places

File 542168ae-x86emul-only-emulate-swint-injection-for-real-mode.patch of Package xen.196

Places