Home Home > GIT Browse > openSUSE-15.0
summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorJiri Kosina <jkosina@suse.cz>2015-11-12 13:22:22 +0100
committerJiri Kosina <jkosina@suse.cz>2015-11-12 13:22:22 +0100
commitb5b212e847eb6efeeec4d2a92258bfacb4d0876b (patch)
tree28a03f8c13360a4fdeb70ea823702fe5cab72c70
parent3c1b5532191d7f28ad838dfd366e28f54190a55d (diff)
parent1cd6391406f8e81ba9904e8c61edf434450b7293 (diff)
Merge remote-tracking branch 'origin/cve/linux-3.0' into SLE11-SP3rpm-3.0.101-0.47.71
Conflicts: series.conf
-rw-r--r--patches.fixes/kvm-svm-unconditionally-intercept-db78
-rw-r--r--patches.fixes/kvm-x86-work-around-infinite-loop-in-microcode-when-ac-is-delivered85
-rw-r--r--series.conf6
3 files changed, 169 insertions, 0 deletions
diff --git a/patches.fixes/kvm-svm-unconditionally-intercept-db b/patches.fixes/kvm-svm-unconditionally-intercept-db
new file mode 100644
index 0000000000..ccedefbdc1
--- /dev/null
+++ b/patches.fixes/kvm-svm-unconditionally-intercept-db
@@ -0,0 +1,78 @@
+From: Paolo Bonzini <pbonzini@redhat.com>
+Date: Tue, 10 Nov 2015 09:14:39 +0100
+Subject: KVM: svm: unconditionally intercept #DB
+Git-commit: cbdb967af3d54993f5814f1cee0ed311a055377d
+Patch-mainline: 4.4-rc1
+References: CVE-2015-8104 bsc#954404
+
+This is needed to avoid the possibility that the guest triggers
+an infinite stream of #DB exceptions (CVE-2015-8104).
+
+VMX is not affected: because it does not save DR6 in the VMCS,
+it already intercepts #DB unconditionally.
+
+Reported-by: Jan Beulich <jbeulich@suse.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Acked-by: Joerg Roedel <jroedel@suse.de>
+---
+ arch/x86/kvm/svm.c | 14 +++-----------
+ 1 file changed, 3 insertions(+), 11 deletions(-)
+
+--- a/arch/x86/kvm/svm.c
++++ b/arch/x86/kvm/svm.c
+@@ -1010,6 +1010,7 @@
+ set_exception_intercept(svm, UD_VECTOR);
+ set_exception_intercept(svm, MC_VECTOR);
+ set_exception_intercept(svm, AC_VECTOR);
++ set_exception_intercept(svm, DB_VECTOR);
+
+ set_intercept(svm, INTERCEPT_INTR);
+ set_intercept(svm, INTERCEPT_NMI);
+@@ -1542,20 +1543,13 @@
+ mark_dirty(svm->vmcb, VMCB_SEG);
+ }
+
+-static void update_db_intercept(struct kvm_vcpu *vcpu)
++static void update_bp_intercept(struct kvm_vcpu *vcpu)
+ {
+ struct vcpu_svm *svm = to_svm(vcpu);
+
+- clr_exception_intercept(svm, DB_VECTOR);
+ clr_exception_intercept(svm, BP_VECTOR);
+
+- if (svm->nmi_singlestep)
+- set_exception_intercept(svm, DB_VECTOR);
+-
+ if (vcpu->guest_debug & KVM_GUESTDBG_ENABLE) {
+- if (vcpu->guest_debug &
+- (KVM_GUESTDBG_SINGLESTEP | KVM_GUESTDBG_USE_HW_BP))
+- set_exception_intercept(svm, DB_VECTOR);
+ if (vcpu->guest_debug & KVM_GUESTDBG_USE_SW_BP)
+ set_exception_intercept(svm, BP_VECTOR);
+ } else
+@@ -1573,7 +1567,7 @@
+
+ mark_dirty(svm->vmcb, VMCB_DR);
+
+- update_db_intercept(vcpu);
++ update_bp_intercept(vcpu);
+ }
+
+ static void new_asid(struct vcpu_svm *svm, struct svm_cpu_data *sd)
+@@ -1647,7 +1641,6 @@
+ if (!(svm->vcpu.guest_debug & KVM_GUESTDBG_SINGLESTEP))
+ svm->vmcb->save.rflags &=
+ ~(X86_EFLAGS_TF | X86_EFLAGS_RF);
+- update_db_intercept(&svm->vcpu);
+ }
+
+ if (svm->vcpu.guest_debug &
+@@ -3545,7 +3538,6 @@
+ */
+ svm->nmi_singlestep = true;
+ svm->vmcb->save.rflags |= (X86_EFLAGS_TF | X86_EFLAGS_RF);
+- update_db_intercept(vcpu);
+ }
+
+ static int svm_set_tss_addr(struct kvm *kvm, unsigned int addr)
diff --git a/patches.fixes/kvm-x86-work-around-infinite-loop-in-microcode-when-ac-is-delivered b/patches.fixes/kvm-x86-work-around-infinite-loop-in-microcode-when-ac-is-delivered
new file mode 100644
index 0000000000..adf5f3ed4c
--- /dev/null
+++ b/patches.fixes/kvm-x86-work-around-infinite-loop-in-microcode-when-ac-is-delivered
@@ -0,0 +1,85 @@
+From: Eric Northup <digitaleric@google.com>
+Date: Tue, 3 Nov 2015 18:03:53 +0100
+Subject: KVM: x86: work around infinite loop in microcode when #AC is delivered
+Git-commit: 54a20552e1eae07aa240fa370a0293e006b5faed
+Patch-mainline: 4.4-rc1
+References: CVE-2015-5307 bsc#953527
+
+It was found that a guest can DoS a host by triggering an infinite
+stream of "alignment check" (#AC) exceptions. This causes the
+microcode to enter an infinite loop where the core never receives
+another interrupt. The host kernel panics pretty quickly due to the
+effects (CVE-2015-5307).
+
+Signed-off-by: Eric Northup <digitaleric@google.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Acked-by: Joerg Roedel <jroedel@suse.de>
+---
+ arch/x86/include/uapi/asm/svm.h | 1 +
+ arch/x86/kvm/svm.c | 8 ++++++++
+ arch/x86/kvm/vmx.c | 5 ++++-
+ 3 files changed, 13 insertions(+), 1 deletion(-)
+
+--- a/arch/x86/kvm/svm.c
++++ b/arch/x86/kvm/svm.c
+@@ -1009,6 +1009,7 @@
+ set_exception_intercept(svm, PF_VECTOR);
+ set_exception_intercept(svm, UD_VECTOR);
+ set_exception_intercept(svm, MC_VECTOR);
++ set_exception_intercept(svm, AC_VECTOR);
+
+ set_intercept(svm, INTERCEPT_INTR);
+ set_intercept(svm, INTERCEPT_NMI);
+@@ -1681,6 +1682,12 @@
+ return 1;
+ }
+
++static int ac_interception(struct vcpu_svm *svm)
++{
++ kvm_queue_exception_e(&svm->vcpu, AC_VECTOR, 0);
++ return 1;
++}
++
+ static void svm_fpu_activate(struct kvm_vcpu *vcpu)
+ {
+ struct vcpu_svm *svm = to_svm(vcpu);
+@@ -3177,6 +3184,7 @@
+ [SVM_EXIT_EXCP_BASE + PF_VECTOR] = pf_interception,
+ [SVM_EXIT_EXCP_BASE + NM_VECTOR] = nm_interception,
+ [SVM_EXIT_EXCP_BASE + MC_VECTOR] = mc_interception,
++ [SVM_EXIT_EXCP_BASE + AC_VECTOR] = ac_interception,
+ [SVM_EXIT_INTR] = intr_interception,
+ [SVM_EXIT_NMI] = nmi_interception,
+ [SVM_EXIT_SMI] = nop_on_interception,
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -720,7 +720,7 @@
+ u32 eb;
+
+ eb = (1u << PF_VECTOR) | (1u << UD_VECTOR) | (1u << MC_VECTOR) |
+- (1u << NM_VECTOR) | (1u << DB_VECTOR);
++ (1u << NM_VECTOR) | (1u << DB_VECTOR) | (1u << AC_VECTOR);
+ if ((vcpu->guest_debug &
+ (KVM_GUESTDBG_ENABLE | KVM_GUESTDBG_USE_SW_BP)) ==
+ (KVM_GUESTDBG_ENABLE | KVM_GUESTDBG_USE_SW_BP))
+@@ -3278,6 +3278,9 @@
+
+ ex_no = intr_info & INTR_INFO_VECTOR_MASK;
+ switch (ex_no) {
++ case AC_VECTOR:
++ kvm_queue_exception_e(vcpu, AC_VECTOR, error_code);
++ return 1;
+ case DB_VECTOR:
+ dr6 = vmcs_readl(EXIT_QUALIFICATION);
+ if (!(vcpu->guest_debug &
+--- a/arch/x86/include/asm/kvm_host.h
++++ b/arch/x86/include/asm/kvm_host.h
+@@ -82,6 +82,7 @@
+ #define GP_VECTOR 13
+ #define PF_VECTOR 14
+ #define MF_VECTOR 16
++#define AC_VECTOR 17
+ #define MC_VECTOR 18
+
+ #define SELECTOR_TI_MASK (1 << 2)
diff --git a/series.conf b/series.conf
index b2932d43be..61e7bd65cd 100644
--- a/series.conf
+++ b/series.conf
@@ -17584,6 +17584,11 @@
# bsc#948330
patches.fixes/0001-x86-mm-only-do-a-local-tlb-flush-in-ptep_set_access_.patch
patches.fixes/0002-x86-mm-drop-TLB-flush-from-ptep_set_access_flags.patch
+ # bsc#953527 - VUL-0: CVE-2015-5307: kernel: kvm: x86: avoid guest->host DOS by intercepting #AC
+ patches.fixes/kvm-x86-work-around-infinite-loop-in-microcode-when-ac-is-delivered
+
+ # bsc#954404 - VUL-0: CVE-2015-8104: virt: guest to host DoS by triggering an infinite loop in microcode via #DB exception
+ patches.fixes/kvm-svm-unconditionally-intercept-db
########################################################
# You'd better have a good reason for adding a patch
@@ -17837,3 +17842,4 @@
patches.xen/xen-x86_64-unmapped-initrd
# Xen-only kABI adjustments
patches.kabi/1231-netfront-limit-skblen.patch
+