[linux] 01/02: [x86] kvm: fix page struct leak in handle_vmon (CVE-2017-2596)

[debian-kernel at lists.debian.org]

This is an automated email from the git hooks/post-receive script.

benh pushed a commit to branch jessie-security
in repository linux.

commit 5b57e2369607aecde0380c8c976d7beb1f997f75
Author: Ben Hutchings <ben at decadent.org.uk>
Date:   Tue Feb 21 19:28:21 2017 +0000

    [x86] kvm: fix page struct leak in handle_vmon (CVE-2017-2596)
---
 debian/changelog                                   |  1 +
 .../kvm-fix-page-struct-leak-in-handle_vmon.patch  | 40 ++++++++++++++++++++++
 debian/patches/series                              |  1 +
 3 files changed, 42 insertions(+)

diff --git a/debian/changelog b/debian/changelog
index 2fda558..52f66ce 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -18,6 +18,7 @@ linux (3.16.39-1+deb8u1) UNRELEASED; urgency=medium
   * USB: serial: kl5kusb105: fix line-state error handling (CVE-2017-5549)
   * tmpfs: clear S_ISGID when setting posix ACLs (CVE-2017-5551)
   * ip6_gre: fix ip6gre_err() invalid reads (CVE-2017-5897)
+  * [x86] kvm: fix page struct leak in handle_vmon (CVE-2017-2596)
 
  -- Salvatore Bonaccorso <carnil at debian.org>  Sat, 18 Feb 2017 18:26:58 +0100
 
diff --git a/debian/patches/bugfix/x86/kvm-fix-page-struct-leak-in-handle_vmon.patch b/debian/patches/bugfix/x86/kvm-fix-page-struct-leak-in-handle_vmon.patch
new file mode 100644
index 0000000..c8872a6
--- /dev/null
+++ b/debian/patches/bugfix/x86/kvm-fix-page-struct-leak-in-handle_vmon.patch
@@ -0,0 +1,40 @@
+From: Paolo Bonzini <pbonzini at redhat.com>
+Date: Tue, 24 Jan 2017 11:56:21 +0100
+Subject: kvm: fix page struct leak in handle_vmon
+Origin: https://git.kernel.org/cgit/virt/kvm/kvm.git/commit?id=06ce521af9558814b8606c0476c54497cf83a653
+Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2017-2596
+
+handle_vmon gets a reference on VMXON region page,
+but does not release it. Release the reference.
+
+Found by syzkaller; based on a patch by Dmitry.
+
+Reported-by: Dmitry Vyukov <dvyukov at google.com>
+Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>
+[bwh: Backported to 3.16: use skip_emulated_instruction()]
+---
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -5949,14 +5949,20 @@ static int nested_vmx_check_vmptr(struct
+ 		}
+ 
+ 		page = nested_get_page(vcpu, vmptr);
+-		if (page == NULL ||
+-		    *(u32 *)kmap(page) != VMCS12_REVISION) {
++		if (page == NULL) {
+ 			nested_vmx_failInvalid(vcpu);
++			skip_emulated_instruction(vcpu);
++			return 1;
++		}
++		if (*(u32 *)kmap(page) != VMCS12_REVISION) {
+ 			kunmap(page);
++			nested_release_page_clean(page);
++			nested_vmx_failInvalid(vcpu);
+ 			skip_emulated_instruction(vcpu);
+ 			return 1;
+ 		}
+ 		kunmap(page);
++		nested_release_page_clean(page);
+ 		vmx->nested.vmxon_ptr = vmptr;
+ 		break;
+ 	case EXIT_REASON_VMCLEAR:
diff --git a/debian/patches/series b/debian/patches/series
index 10ca00b..c613ea7 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -692,6 +692,7 @@ bugfix/all/selinux-fix-off-by-one-in-setprocattr.patch
 bugfix/all/usb-serial-kl5kusb105-fix-line-state-error-handling.patch
 bugfix/all/tmpfs-clear-s_isgid-when-setting-posix-acls.patch
 bugfix/all/ip6_gre-fix-ip6gre_err-invalid-reads.patch
+bugfix/x86/kvm-fix-page-struct-leak-in-handle_vmon.patch
 
 # Fix ABI changes
 debian/of-fix-abi-changes.patch

-- 
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/kernel/linux.git