[linux] 01/03: [x86] KVM: fix singlestepping over syscall (CVE-2017-7518)

debian-kernel at lists.debian.org debian-kernel at lists.debian.org
Thu Aug 17 20:22:23 UTC 2017


This is an automated email from the git hooks/post-receive script.

benh pushed a commit to branch jessie-security
in repository linux.

commit 3a479eeefd1b981359c49c5cad2834a320d56ef1
Author: Ben Hutchings <ben at decadent.org.uk>
Date:   Sun Aug 6 12:20:34 2017 +0100

    [x86] KVM: fix singlestepping over syscall (CVE-2017-7518)
---
 debian/changelog                                   |   6 +
 .../kvm-x86-fix-singlestepping-over-syscall.patch  | 128 +++++++++++++++++++++
 debian/patches/series                              |   1 +
 3 files changed, 135 insertions(+)

diff --git a/debian/changelog b/debian/changelog
index ee09582..e547580 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,9 @@
+linux (3.16.43-2+deb8u4) UNRELEASED; urgency=medium
+
+  * [x86] KVM: fix singlestepping over syscall (CVE-2017-7518)
+
+ -- Ben Hutchings <ben at decadent.org.uk>  Sun, 06 Aug 2017 22:03:56 +0100
+
 linux (3.16.43-2+deb8u3) jessie-security; urgency=high
 
   * regulator: core: Fix regualtor_ena_gpio_free not to access pin after
diff --git a/debian/patches/bugfix/x86/kvm-x86-fix-singlestepping-over-syscall.patch b/debian/patches/bugfix/x86/kvm-x86-fix-singlestepping-over-syscall.patch
new file mode 100644
index 0000000..aff369e
--- /dev/null
+++ b/debian/patches/bugfix/x86/kvm-x86-fix-singlestepping-over-syscall.patch
@@ -0,0 +1,128 @@
+From: Paolo Bonzini <pbonzini at redhat.com>
+Date: Wed, 7 Jun 2017 15:13:14 +0200
+Subject: KVM: x86: fix singlestepping over syscall
+Origin: https://git.kernel.org/linus/c8401dda2f0a00cd25c0af6a95ed50e478d25de4
+Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2017-7518
+
+TF is handled a bit differently for syscall and sysret, compared
+to the other instructions: TF is checked after the instruction completes,
+so that the OS can disable #DB at a syscall by adding TF to FMASK.
+When the sysret is executed the #DB is taken "as if" the syscall insn
+just completed.
+
+KVM emulates syscall so that it can trap 32-bit syscall on Intel processors.
+Fix the behavior, otherwise you could get #DB on a user stack which is not
+nice.  This does not affect Linux guests, as they use an IST or task gate
+for #DB.
+
+This fixes CVE-2017-7518.
+
+Reported-by: Andy Lutomirski <luto at kernel.org>
+Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>
+Signed-off-by: Radim Krčmář <rkrcmar at redhat.com>
+[bwh: Backported to 3.16:
+ - kvm_vcpu_check_singlestep() did not take an rflags parameter but
+   called get_rflags() itself; delete that code
+ - kvm_vcpu_check_singlestep() sets some flags differently
+ - Drop changes to kvm_skip_emulated_instruction()]
+Signed-off-by: Ben Hutchings <ben at decadent.org.uk>
+---
+--- a/arch/x86/include/asm/kvm_emulate.h
++++ b/arch/x86/include/asm/kvm_emulate.h
+@@ -274,6 +274,7 @@ struct x86_emulate_ctxt {
+ 	bool guest_mode; /* guest running a nested guest */
+ 	bool perm_ok; /* do not check permissions if true */
+ 	bool ud;	/* inject an #UD if host doesn't support insn */
++	bool tf;	/* TF value before instruction (after for syscall/sysret) */
+ 
+ 	bool have_exception;
+ 	struct x86_exception exception;
+--- a/arch/x86/kvm/emulate.c
++++ b/arch/x86/kvm/emulate.c
+@@ -2312,6 +2312,7 @@ static int em_syscall(struct x86_emulate
+ 		ctxt->eflags &= ~(EFLG_VM | EFLG_IF | EFLG_RF);
+ 	}
+ 
++	ctxt->tf = (ctxt->eflags & X86_EFLAGS_TF) != 0;
+ 	return X86EMUL_CONTINUE;
+ }
+ 
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -4966,6 +4966,8 @@ static void init_emulate_ctxt(struct kvm
+ 	kvm_x86_ops->get_cs_db_l_bits(vcpu, &cs_db, &cs_l);
+ 
+ 	ctxt->eflags = kvm_get_rflags(vcpu);
++	ctxt->tf = (ctxt->eflags & X86_EFLAGS_TF) != 0;
++
+ 	ctxt->eip = kvm_rip_read(vcpu);
+ 	ctxt->mode = (!is_protmode(vcpu))		? X86EMUL_MODE_REAL :
+ 		     (ctxt->eflags & X86_EFLAGS_VM)	? X86EMUL_MODE_VM86 :
+@@ -5156,38 +5158,26 @@ static int kvm_vcpu_check_hw_bp(unsigned
+ 	return dr6;
+ }
+ 
+-static void kvm_vcpu_check_singlestep(struct kvm_vcpu *vcpu, int *r)
++static void kvm_vcpu_do_singlestep(struct kvm_vcpu *vcpu, int *r)
+ {
+ 	struct kvm_run *kvm_run = vcpu->run;
+ 
+-	/*
+-	 * Use the "raw" value to see if TF was passed to the processor.
+-	 * Note that the new value of the flags has not been saved yet.
+-	 *
+-	 * This is correct even for TF set by the guest, because "the
+-	 * processor will not generate this exception after the instruction
+-	 * that sets the TF flag".
+-	 */
+-	unsigned long rflags = kvm_x86_ops->get_rflags(vcpu);
+-
+-	if (unlikely(rflags & X86_EFLAGS_TF)) {
+-		if (vcpu->guest_debug & KVM_GUESTDBG_SINGLESTEP) {
+-			kvm_run->debug.arch.dr6 = DR6_BS | DR6_FIXED_1;
+-			kvm_run->debug.arch.pc = vcpu->arch.singlestep_rip;
+-			kvm_run->debug.arch.exception = DB_VECTOR;
+-			kvm_run->exit_reason = KVM_EXIT_DEBUG;
+-			*r = EMULATE_USER_EXIT;
+-		} else {
+-			vcpu->arch.emulate_ctxt.eflags &= ~X86_EFLAGS_TF;
+-			/*
+-			 * "Certain debug exceptions may clear bit 0-3.  The
+-			 * remaining contents of the DR6 register are never
+-			 * cleared by the processor".
+-			 */
+-			vcpu->arch.dr6 &= ~15;
+-			vcpu->arch.dr6 |= DR6_BS;
+-			kvm_queue_exception(vcpu, DB_VECTOR);
+-		}
++	if (vcpu->guest_debug & KVM_GUESTDBG_SINGLESTEP) {
++		kvm_run->debug.arch.dr6 = DR6_BS | DR6_FIXED_1;
++		kvm_run->debug.arch.pc = vcpu->arch.singlestep_rip;
++		kvm_run->debug.arch.exception = DB_VECTOR;
++		kvm_run->exit_reason = KVM_EXIT_DEBUG;
++		*r = EMULATE_USER_EXIT;
++	} else {
++		vcpu->arch.emulate_ctxt.eflags &= ~X86_EFLAGS_TF;
++		/*
++		 * "Certain debug exceptions may clear bit 0-3.  The
++		 * remaining contents of the DR6 register are never
++		 * cleared by the processor".
++		 */
++		vcpu->arch.dr6 &= ~15;
++		vcpu->arch.dr6 |= DR6_BS;
++		kvm_queue_exception(vcpu, DB_VECTOR);
+ 	}
+ }
+ 
+@@ -5340,8 +5330,9 @@ restart:
+ 		kvm_make_request(KVM_REQ_EVENT, vcpu);
+ 		vcpu->arch.emulate_regs_need_sync_to_vcpu = false;
+ 		kvm_rip_write(vcpu, ctxt->eip);
+-		if (r == EMULATE_DONE)
+-			kvm_vcpu_check_singlestep(vcpu, &r);
++		if (r == EMULATE_DONE &&
++		    (ctxt->tf || (vcpu->guest_debug & KVM_GUESTDBG_SINGLESTEP)))
++			kvm_vcpu_do_singlestep(vcpu, &r);
+ 		kvm_set_rflags(vcpu, ctxt->eflags);
+ 	} else
+ 		vcpu->arch.emulate_regs_need_sync_to_vcpu = true;
diff --git a/debian/patches/series b/debian/patches/series
index 2759b04..7e3cee9 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -724,6 +724,7 @@ bugfix/all/mqueue-fix-a-use-after-free-in-sys_mq_notify.patch
 bugfix/all/char-lp-fix-possible-integer-overflow-in-lp_setup.patch
 bugfix/all/fs-exec.c-account-for-argv-envp-pointers.patch
 bugfix/all/dentry-name-snapshots.patch
+bugfix/x86/kvm-x86-fix-singlestepping-over-syscall.patch
 
 # Fix ABI changes
 debian/of-fix-abi-changes.patch

-- 
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/kernel/linux.git



More information about the Kernel-svn-changes mailing list