Browse code
linux kernel: fix for CVE-2018-16882
Original patch available at:
https://marc.info/?l=kvm&m=154514994222809&w=2
To apply on v4.4.171, added following to original patch:
+ vmx->nested.pi_desc_page = NULL;
Change-Id: I7cebdbe3eb3db8177ba2e1cecda6099547a0db48
Reviewed-on: http://photon-jenkins.eng.vmware.com:8082/6638
Tested-by: gerrit-photon <photon-checkins@vmware.com>
Reviewed-by: Srinidhi Rao <srinidhir@vmware.com>
Ajay Kaher authored on 2019/02/04 06:28:35Showing 2 changed files
| 1 | 1 |
new file mode 100644 |
| ... | ... |
@@ -0,0 +1,58 @@ |
| 0 |
+From c2dd5146e9fe1f22c77c1b011adf84eea0245806 Mon Sep 17 00:00:00 2001 |
|
| 1 |
+From: Cfir Cohen <cfir@google.com> |
|
| 2 |
+Date: Tue, 18 Dec 2018 08:18:41 -0800 |
|
| 3 |
+Subject: KVM: Fix UAF in nested posted interrupt processing |
|
| 4 |
+Commit: c2dd5146e9fe1f22c77c1b011adf84eea0245806 |
|
| 5 |
+ |
|
| 6 |
+nested_get_vmcs12_pages() processes the posted_intr address in vmcs12. It |
|
| 7 |
+caches the kmap()ed page object and pointer, however, it doesn't handle |
|
| 8 |
+errors correctly: it's possible to cache a valid pointer, then release |
|
| 9 |
+the page and later dereference the dangling pointer. |
|
| 10 |
+ |
|
| 11 |
+I was able to reproduce with the following steps: |
|
| 12 |
+ |
|
| 13 |
+1. Call vmlaunch with valid posted_intr_desc_addr but an invalid |
|
| 14 |
+MSR_EFER. This causes nested_get_vmcs12_pages() to cache the kmap()ed |
|
| 15 |
+pi_desc_page and pi_desc. Later the invalid EFER value fails |
|
| 16 |
+check_vmentry_postreqs() which fails the first vmlaunch. |
|
| 17 |
+ |
|
| 18 |
+2. Call vmlanuch with a valid EFER but an invalid posted_intr_desc_addr |
|
| 19 |
+(I set it to 2G - 0x80). The second time we call nested_get_vmcs12_pages |
|
| 20 |
+pi_desc_page is unmapped and released and pi_desc_page is set to NULL |
|
| 21 |
+(the "shouldn't happen" clause). Due to the invalid |
|
| 22 |
+posted_intr_desc_addr, kvm_vcpu_gpa_to_page() fails and |
|
| 23 |
+nested_get_vmcs12_pages() returns. It doesn't return an error value so |
|
| 24 |
+vmlaunch proceeds. Note that at this time we have a dangling pointer in |
|
| 25 |
+vmx->nested.pi_desc and POSTED_INTR_DESC_ADDR in L0's vmcs. |
|
| 26 |
+ |
|
| 27 |
+3. Issue an IPI in L2 guest code. This triggers a call to |
|
| 28 |
+vmx_complete_nested_posted_interrupt() and pi_test_and_clear_on() which |
|
| 29 |
+dereferences the dangling pointer. |
|
| 30 |
+ |
|
| 31 |
+Vulnerable code requires nested and enable_apicv variables to be set to |
|
| 32 |
+true. The host CPU must also support posted interrupts. |
|
| 33 |
+ |
|
| 34 |
+Fixes: 5e2f30b756a37 "KVM: nVMX: get rid of nested_get_page()" |
|
| 35 |
+Cc: stable@vger.kernel.org |
|
| 36 |
+Reviewed-by: Andy Honig <ahonig@google.com> |
|
| 37 |
+Signed-off-by: Cfir Cohen <cfir@google.com> |
|
| 38 |
+Reviewed-by: Liran Alon <liran.alon@oracle.com> |
|
| 39 |
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> |
|
| 40 |
+Signed-off-by: Ajay Kaher <akaher@vmware.com> |
|
| 41 |
+--- |
|
| 42 |
+ arch/x86/kvm/vmx.c | 2 ++ |
|
| 43 |
+ 1 file changed, 2 insertions(+) |
|
| 44 |
+ |
|
| 45 |
+diff -Naur linux-4.4.171/arch/x86/kvm/vmx.c linux-4.4.171_CVE-2018-16882/arch/x86/kvm/vmx.c |
|
| 46 |
+--- linux-4.4.171/arch/x86/kvm/vmx.c 2019-01-17 02:46:12.000000000 +0530 |
|
| 47 |
+@@ -9284,6 +9284,9 @@ |
|
| 48 |
+ if (vmx->nested.pi_desc_page) { /* shouldn't happen */
|
|
| 49 |
+ kunmap(vmx->nested.pi_desc_page); |
|
| 50 |
+ nested_release_page(vmx->nested.pi_desc_page); |
|
| 51 |
++ vmx->nested.pi_desc_page = NULL; |
|
| 52 |
++ vmx->nested.pi_desc = NULL; |
|
| 53 |
++ vmcs_write64(POSTED_INTR_DESC_ADDR, -1ull); |
|
| 54 |
+ } |
|
| 55 |
+ vmx->nested.pi_desc_page = |
|
| 56 |
+ nested_get_page(vcpu, vmcs12->posted_intr_desc_addr); |
| ... | ... |
@@ -2,7 +2,7 @@ |
| 2 | 2 |
Summary: Kernel |
| 3 | 3 |
Name: linux |
| 4 | 4 |
Version: 4.4.171 |
| 5 |
-Release: 1%{?kat_build:.%kat_build}%{?dist}
|
|
| 5 |
+Release: 2%{?kat_build:.%kat_build}%{?dist}
|
|
| 6 | 6 |
License: GPLv2 |
| 7 | 7 |
URL: http://www.kernel.org/ |
| 8 | 8 |
Group: System Environment/Kernel |
| ... | ... |
@@ -61,6 +61,8 @@ Patch39: 0006-xfs-verify-dinode-header-first.patch |
| 61 | 61 |
Patch40: 0007-xfs-move-inode-fork-verifiers-to-xfs_dinode_verify.patch |
| 62 | 62 |
Patch41: 0008-xfs-enhance-dinode-verifier.patch |
| 63 | 63 |
Patch42: net-9p-vdfs-zerocopy.patch |
| 64 |
+# Fix for CVE-2018-16882 |
|
| 65 |
+Patch43: 0001-KVM_Fix_UAF_in_nested_posted_interrupt_processing.patch |
|
| 64 | 66 |
|
| 65 | 67 |
# For Spectre |
| 66 | 68 |
Patch67: 0169-x86-syscall-Clear-unused-extra-registers-on-syscall-.patch |
| ... | ... |
@@ -177,6 +179,7 @@ This package contains the 'perf' performance analysis tools for Linux kernel. |
| 177 | 177 |
%patch40 -p1 |
| 178 | 178 |
%patch41 -p1 |
| 179 | 179 |
%patch42 -p1 |
| 180 |
+%patch43 -p1 |
|
| 180 | 181 |
|
| 181 | 182 |
%patch67 -p1 |
| 182 | 183 |
|
| ... | ... |
@@ -335,6 +338,8 @@ ln -sf %{name}-%{uname_r}.cfg /boot/photon.cfg
|
| 335 | 335 |
/usr/share/perf-core |
| 336 | 336 |
|
| 337 | 337 |
%changelog |
| 338 |
+* Wed Jan 30 2019 Ajay Kaher <akaher@vmware.com> 4.4.171-2 |
|
| 339 |
+- Fix CVE-2018-16882 |
|
| 338 | 340 |
* Thu Jan 24 2019 Ajay Kaher <akaher@vmware.com> 4.4.171-1 |
| 339 | 341 |
- Update to version 4.4.171 |
| 340 | 342 |
* Tue Jan 15 2019 Alexey Makhalov <amakhalov@vmware.com> 4.4.164-4 |