[linux] 02/02: [x86] KVM: svm: unconditionally intercept #DB (CVE-2015-8104)
debian-kernel at lists.debian.org
debian-kernel at lists.debian.org
Thu Nov 19 15:20:46 UTC 2015
This is an automated email from the git hooks/post-receive script.
benh pushed a commit to branch jessie
in repository linux.
commit d59dc05bbb603ca8d9cb71875bd9a37beb6f9283
Author: Ben Hutchings <ben at decadent.org.uk>
Date: Thu Nov 19 15:11:54 2015 +0000
[x86] KVM: svm: unconditionally intercept #DB (CVE-2015-8104)
---
debian/changelog | 1 +
.../x86/kvm-svm-unconditionally-intercept-DB.patch | 80 ++++++++++++++++++++++
debian/patches/series | 1 +
3 files changed, 82 insertions(+)
diff --git a/debian/changelog b/debian/changelog
index b816fd5..8a0bce9 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -219,6 +219,7 @@ linux (3.16.7-ckt20-1) UNRELEASED; urgency=medium
* firmware_class: Fix condition in directory search loop (Closes: #804862)
* ehci: Fix ABI change in 3.16.7-ckt19
* [arm64] Defer workaround for erratum #843419
+ * [x86] KVM: svm: unconditionally intercept #DB (CVE-2015-8104)
-- Aurelien Jarno <aurel32 at debian.org> Sat, 03 Oct 2015 22:32:19 +0200
diff --git a/debian/patches/bugfix/x86/kvm-svm-unconditionally-intercept-DB.patch b/debian/patches/bugfix/x86/kvm-svm-unconditionally-intercept-DB.patch
new file mode 100644
index 0000000..efa115e
--- /dev/null
+++ b/debian/patches/bugfix/x86/kvm-svm-unconditionally-intercept-DB.patch
@@ -0,0 +1,80 @@
+From: Paolo Bonzini <pbonzini at redhat.com>
+Date: Tue, 10 Nov 2015 09:14:39 +0100
+Subject: KVM: svm: unconditionally intercept #DB
+Origin: https://git.kernel.org/linus/cbdb967af3d54993f5814f1cee0ed311a055377d
+
+This is needed to avoid the possibility that the guest triggers
+an infinite stream of #DB exceptions (CVE-2015-8104).
+
+VMX is not affected: because it does not save DR6 in the VMCS,
+it already intercepts #DB unconditionally.
+
+Reported-by: Jan Beulich <jbeulich at suse.com>
+Cc: stable at vger.kernel.org
+Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>
+---
+ arch/x86/kvm/svm.c | 14 +++-----------
+ 1 file changed, 3 insertions(+), 11 deletions(-)
+
+diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
+index 1839264..1cc1ffc 100644
+--- a/arch/x86/kvm/svm.c
++++ b/arch/x86/kvm/svm.c
+@@ -1020,6 +1020,7 @@ static void init_vmcb(struct vcpu_svm *svm)
+ set_exception_intercept(svm, UD_VECTOR);
+ set_exception_intercept(svm, MC_VECTOR);
+ set_exception_intercept(svm, AC_VECTOR);
++ set_exception_intercept(svm, DB_VECTOR);
+
+ set_intercept(svm, INTERCEPT_INTR);
+ set_intercept(svm, INTERCEPT_NMI);
+@@ -1554,20 +1555,13 @@ static void svm_set_segment(struct kvm_vcpu *vcpu,
+ mark_dirty(svm->vmcb, VMCB_SEG);
+ }
+
+-static void update_db_bp_intercept(struct kvm_vcpu *vcpu)
++static void update_bp_intercept(struct kvm_vcpu *vcpu)
+ {
+ struct vcpu_svm *svm = to_svm(vcpu);
+
+- clr_exception_intercept(svm, DB_VECTOR);
+ clr_exception_intercept(svm, BP_VECTOR);
+
+- if (svm->nmi_singlestep)
+- set_exception_intercept(svm, DB_VECTOR);
+-
+ if (vcpu->guest_debug & KVM_GUESTDBG_ENABLE) {
+- if (vcpu->guest_debug &
+- (KVM_GUESTDBG_SINGLESTEP | KVM_GUESTDBG_USE_HW_BP))
+- set_exception_intercept(svm, DB_VECTOR);
+ if (vcpu->guest_debug & KVM_GUESTDBG_USE_SW_BP)
+ set_exception_intercept(svm, BP_VECTOR);
+ } else
+@@ -1673,7 +1667,6 @@ static int db_interception(struct vcpu_svm *svm)
+ if (!(svm->vcpu.guest_debug & KVM_GUESTDBG_SINGLESTEP))
+ svm->vmcb->save.rflags &=
+ ~(X86_EFLAGS_TF | X86_EFLAGS_RF);
+- update_db_bp_intercept(&svm->vcpu);
+ }
+
+ if (svm->vcpu.guest_debug &
+@@ -3661,7 +3654,6 @@ static void enable_nmi_window(struct kvm_vcpu *vcpu)
+ */
+ svm->nmi_singlestep = true;
+ svm->vmcb->save.rflags |= (X86_EFLAGS_TF | X86_EFLAGS_RF);
+- update_db_bp_intercept(vcpu);
+ }
+
+ static int svm_set_tss_addr(struct kvm *kvm, unsigned int addr)
+@@ -4287,7 +4279,7 @@ static struct kvm_x86_ops svm_x86_ops = {
+ .vcpu_load = svm_vcpu_load,
+ .vcpu_put = svm_vcpu_put,
+
+- .update_db_bp_intercept = update_db_bp_intercept,
++ .update_db_bp_intercept = update_bp_intercept,
+ .get_msr = svm_get_msr,
+ .set_msr = svm_set_msr,
+ .get_segment_base = svm_get_segment_base,
+--
+2.6.2
+
diff --git a/debian/patches/series b/debian/patches/series
index 98440d1..cdb61a4 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -641,3 +641,4 @@ bugfix/all/rds-fix-race-condition-when-sending-a-message-on-unbound-socket.patch
bugfix/x86/kvm-x86-vmx-avoid-guest-host-dos-by-intercepting-ac.patch
bugfix/x86/kvm-x86-svm-intercept-ac-to-avoid-guest-host-exploit.patch
debian/ehci-fix-abi-change-in-3.16.7-ckt19.patch
+bugfix/x86/kvm-svm-unconditionally-intercept-DB.patch
--
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/kernel/linux.git
More information about the Kernel-svn-changes
mailing list