https://github.com/torvalds/linux
Revision d1442d85cc30ea75f7d399474ca738e0bc96f715 authored by Nadav Amit on 18 September 2014, 19:39:39 UTC, committed by Paolo Bonzini on 24 October 2014, 11:21:16 UTC
Far jmp/call/ret may fault while loading a new RIP.  Currently KVM does not
handle this case, and may result in failed vm-entry once the assignment is
done.  The tricky part of doing so is that loading the new CS affects the
VMCS/VMCB state, so if we fail during loading the new RIP, we are left in
unconsistent state.  Therefore, this patch saves on 64-bit the old CS
descriptor and restores it if loading RIP failed.

This fixes CVE-2014-3647.

Cc: stable@vger.kernel.org
Signed-off-by: Nadav Amit <namit@cs.technion.ac.il>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
1 parent 234f3ce
History
Tip revision: d1442d85cc30ea75f7d399474ca738e0bc96f715 authored by Nadav Amit on 18 September 2014, 19:39:39 UTC
KVM: x86: Handle errors when RIP is set during far jumps
Tip revision: d1442d8
File Mode Size
Documentation
arch
block
crypto
drivers
firmware
fs
include
init
ipc
kernel
lib
mm
net
samples
scripts
security
sound
tools
usr
virt
.gitignore -rw-r--r-- 1.1 KB
.mailmap -rw-r--r-- 4.7 KB
COPYING -rw-r--r-- 18.3 KB
CREDITS -rw-r--r-- 93.8 KB
Kbuild -rw-r--r-- 2.5 KB
Kconfig -rw-r--r-- 252 bytes
MAINTAINERS -rw-r--r-- 284.1 KB
Makefile -rw-r--r-- 53.1 KB
README -rw-r--r-- 18.3 KB
REPORTING-BUGS -rw-r--r-- 7.3 KB

README

back to top