[Pkg-xen-changes] [xen] 03/06: x86emul: fully ignore segment override for register-only operations
Bastian Blank
waldi at moszumanska.debian.org
Thu Mar 12 17:35:03 UTC 2015
This is an automated email from the git hooks/post-receive script.
waldi pushed a commit to branch debian/jessie
in repository xen.
commit c6e14813d790bbf6c9400466ff17c4b9d6abee8e
Author: Jan Beulich <jbeulich at suse.com>
Date: Tue Mar 10 13:58:00 2015 +0100
x86emul: fully ignore segment override for register-only operations
For ModRM encoded instructions with register operands we must not
overwrite ea.mem.seg (if a - bogus in that case - segment override was
present) as it aliases with ea.reg.
This is CVE-2015-2151 / XSA-123.
Reported-by: Felix Wilhelm <fwilhelm at ernw.de>
Signed-off-by: Jan Beulich <jbeulich at suse.com>
Reviewed-by: Tim Deegan <tim at xen.org>
Reviewed-by: Keir Fraser <keir at xen.org>
master commit: bcf92a5382b75fd964c1f8678b2d9a3abe6dec39
master date: 2015-03-10 13:45:51 +0100
(cherry picked from commit 4cefc72fc883945dcc71c877ceab779f16e52e76)
Patch-Name: CVE-2015-2151.diff
---
xen/arch/x86/x86_emulate/x86_emulate.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/xen/arch/x86/x86_emulate/x86_emulate.c b/xen/arch/x86/x86_emulate/x86_emulate.c
index 25571c6..9ebff22 100644
--- a/xen/arch/x86/x86_emulate/x86_emulate.c
+++ b/xen/arch/x86/x86_emulate/x86_emulate.c
@@ -1641,7 +1641,7 @@ x86_emulate(
}
}
- if ( override_seg != -1 )
+ if ( override_seg != -1 && ea.type == OP_MEM )
ea.mem.seg = override_seg;
/* Early operand adjustments. */
--
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/pkg-xen/xen.git
More information about the Pkg-xen-changes
mailing list