[linux] 01/03: [x86] kvm: fix page struct leak in handle_vmon (CVE-2017-2596)
debian-kernel at lists.debian.org
debian-kernel at lists.debian.org
Sun Feb 26 21:09:35 UTC 2017
This is an automated email from the git hooks/post-receive script.
benh pushed a commit to branch sid
in repository linux.
commit 003300166ad106537b7669b452bc3035a2f6bd20
Author: Ben Hutchings <ben at decadent.org.uk>
Date: Sun Feb 26 20:29:29 2017 +0000
[x86] kvm: fix page struct leak in handle_vmon (CVE-2017-2596)
---
debian/changelog | 1 +
.../kvm-fix-page-struct-leak-in-handle_vmon.patch | 40 ++++++++++++++++++++++
debian/patches/series | 1 +
3 files changed, 42 insertions(+)
diff --git a/debian/changelog b/debian/changelog
index 9d2b853..6e738f1 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -91,6 +91,7 @@ linux (4.9.13-1) UNRELEASED; urgency=medium
* net: Avoid ABI change for min_header_len
* udeb: Add more USB host and dual-role drivers to usb-modules
(Closes: #856111)
+ * [x86] kvm: fix page struct leak in handle_vmon (CVE-2017-2596)
-- Ben Hutchings <ben at decadent.org.uk> Sat, 18 Feb 2017 00:38:10 +0000
diff --git a/debian/patches/bugfix/x86/kvm-fix-page-struct-leak-in-handle_vmon.patch b/debian/patches/bugfix/x86/kvm-fix-page-struct-leak-in-handle_vmon.patch
new file mode 100644
index 0000000..0f79e13
--- /dev/null
+++ b/debian/patches/bugfix/x86/kvm-fix-page-struct-leak-in-handle_vmon.patch
@@ -0,0 +1,40 @@
+From: Paolo Bonzini <pbonzini at redhat.com>
+Date: Tue, 24 Jan 2017 11:56:21 +0100
+Subject: kvm: fix page struct leak in handle_vmon
+Origin: https://git.kernel.org/linus/06ce521af9558814b8606c0476c54497cf83a653
+Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2017-2596
+
+handle_vmon gets a reference on VMXON region page,
+but does not release it. Release the reference.
+
+Found by syzkaller; based on a patch by Dmitry.
+
+Reported-by: Dmitry Vyukov <dvyukov at google.com>
+Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>
+[bwh: Backported to 4.9: use skip_emulated_instruction()]
+---
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -6925,14 +6925,20 @@ static int nested_vmx_check_vmptr(struct
+ }
+
+ page = nested_get_page(vcpu, vmptr);
+- if (page == NULL ||
+- *(u32 *)kmap(page) != VMCS12_REVISION) {
++ if (page == NULL) {
+ nested_vmx_failInvalid(vcpu);
++ skip_emulated_instruction(vcpu);
++ return 1;
++ }
++ if (*(u32 *)kmap(page) != VMCS12_REVISION) {
+ kunmap(page);
++ nested_release_page_clean(page);
++ nested_vmx_failInvalid(vcpu);
+ skip_emulated_instruction(vcpu);
+ return 1;
+ }
+ kunmap(page);
++ nested_release_page_clean(page);
+ vmx->nested.vmxon_ptr = vmptr;
+ break;
+ case EXIT_REASON_VMCLEAR:
diff --git a/debian/patches/series b/debian/patches/series
index 8486111..28509ec 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -108,6 +108,7 @@ features/all/securelevel/arm64-add-kernel-config-option-to-set-securelevel-wh.pa
# Security fixes
debian/i386-686-pae-pci-set-pci-nobios-by-default.patch
+bugfix/x86/kvm-fix-page-struct-leak-in-handle_vmon.patch
# Fix exported symbol versions
bugfix/ia64/revert-ia64-move-exports-to-definitions.patch
--
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/kernel/linux.git
More information about the Kernel-svn-changes
mailing list