File 58580060-x86-emul-correct-SYSCALL-eflags-handli... of Package xen

Overview Repositories Revisions Requests Users Attributes Meta

File 58580060-x86-emul-correct-SYSCALL-eflags-handling.patch of Package xen (Revision 6bbfc10fa0cd4906a4b565a5ad40b57f)

Currently displaying revision 6bbfc10fa0cd4906a4b565a5ad40b57f , Show latest

# Commit b9a8061bc28930b0c922a5d828447c52e4e873c2
# Date 2016-12-19 15:44:32 +0000
# Author Andrew Cooper <andrew.cooper3@citrix.com>
# Committer Andrew Cooper <andrew.cooper3@citrix.com>
x86/emul: Correct the handling of eflags with SYSCALL

A singlestep #DB is determined by the resulting eflags value from the
execution of SYSCALL, not the original eflags value.

By using the original eflags value, we negate the guest kernels attempt to
protect itself from a privilege escalation by masking TF.

(re)introduce a singlestep boolean, defaulting to the original eflags state,
but have the SYSCALL emulation recalculate it after masking has occurred.

This is XSA-204

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>

--- a/xen/arch/x86/x86_emulate/x86_emulate.c
+++ b/xen/arch/x86/x86_emulate/x86_emulate.c
@@ -4572,6 +4572,23 @@ x86_emulate(
              (rc = ops->write_segment(x86_seg_ss, &sreg, ctxt)) )
             goto done;
 
+        /*
+         * SYSCALL (unlike most instructions) evaluates its singlestep action
+         * based on the resulting EFLG_TF, not the starting EFLG_TF.
+         *
+         * As the #DB is raised after the CPL change and before the OS can
+         * switch stack, it is a large risk for privilege escalation.
+         *
+         * 64bit kernels should mask EFLG_TF in MSR_FMASK to avoid any
+         * vulnerability.  Running the #DB handler on an IST stack is also a
+         * mitigation.
+         *
+         * 32bit kernels have no ability to mask EFLG_TF at all.  Their only
+         * mitigation is to use a task gate for handling #DB (or to not use
+         * enable EFER.SCE to start with).
+         */
+        tf = _regs.eflags & EFLG_TF;
+
         break;
     }
 
@@ -5429,7 +5446,7 @@ x86_emulate(
 
     *ctxt->regs = _regs;
 
-    /* Inject #DB if single-step tracing was enabled at instruction start. */
+    /* Should a singlestep #DB be raised? */
     if ( tf && (rc == X86EMUL_OKAY) && ops->inject_hw_exception )
         rc = ops->inject_hw_exception(EXC_DB, -1, ctxt) ? : X86EMUL_EXCEPTION;

Places

File 58580060-x86-emul-correct-SYSCALL-eflags-handling.patch of Package xen (Revision 6bbfc10fa0cd4906a4b565a5ad40b57f)

Places