From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.0 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SIGNED_OFF_BY, SPF_PASS,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id E932EC43387 for ; Fri, 28 Dec 2018 12:20:58 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id B792820675 for ; Fri, 28 Dec 2018 12:20:58 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1545999658; bh=8f9J3HDGzn4HJ4y3ReeKRdJmGw8Ps56PPJeBBm6b2zg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=nRJhnPy+T9qJj8OcGMfgVo+x/vzbcdlwl0mk02VrDxiNM0kjouWvuG879KC52EtY9 un2vSgcnewFy+OGbDyGP6ta6YeL3at2zzOsGY2sPn6huJxjQVSGzIyKwa+F2OAruvB 98IbikXWPL18qBQbWrgwgcn9hEB38V3g9QbDSpmw= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728786AbeL1MU5 (ORCPT ); Fri, 28 Dec 2018 07:20:57 -0500 Received: from mail.kernel.org ([198.145.29.99]:35338 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1732642AbeL1MQQ (ORCPT ); Fri, 28 Dec 2018 07:16:16 -0500 Received: from localhost (5356596B.cm-6-7b.dynamic.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 5021A2184B; Fri, 28 Dec 2018 12:16:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1545999375; bh=8f9J3HDGzn4HJ4y3ReeKRdJmGw8Ps56PPJeBBm6b2zg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=0r65KqJfJBuG0T/x8ivBHYm2CKfScKhj3RQKeaAzTKH7fp+RhsPxhnNjxWyCUTJ+e hG+7In5h+x+xyuDbP+/oQD8ruKiESeTgBDmpvxEjalL7gEo+WyeDTLt0XaeJHKrX/7 d3SnGDOnuSKRas7dtTqsTT8GG9zV1g2JAgHnrPek= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Andy Honig , Cfir Cohen , Liran Alon , Paolo Bonzini Subject: [PATCH 4.14 25/36] KVM: Fix UAF in nested posted interrupt processing Date: Fri, 28 Dec 2018 12:52:41 +0100 Message-Id: <20181228113128.280581015@linuxfoundation.org> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20181228113126.526729877@linuxfoundation.org> References: <20181228113126.526729877@linuxfoundation.org> User-Agent: quilt/0.65 X-stable: review X-Patchwork-Hint: ignore MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 4.14-stable review patch. If anyone has any objections, please let me know. ------------------ From: Cfir Cohen commit c2dd5146e9fe1f22c77c1b011adf84eea0245806 upstream. nested_get_vmcs12_pages() processes the posted_intr address in vmcs12. It caches the kmap()ed page object and pointer, however, it doesn't handle errors correctly: it's possible to cache a valid pointer, then release the page and later dereference the dangling pointer. I was able to reproduce with the following steps: 1. Call vmlaunch with valid posted_intr_desc_addr but an invalid MSR_EFER. This causes nested_get_vmcs12_pages() to cache the kmap()ed pi_desc_page and pi_desc. Later the invalid EFER value fails check_vmentry_postreqs() which fails the first vmlaunch. 2. Call vmlanuch with a valid EFER but an invalid posted_intr_desc_addr (I set it to 2G - 0x80). The second time we call nested_get_vmcs12_pages pi_desc_page is unmapped and released and pi_desc_page is set to NULL (the "shouldn't happen" clause). Due to the invalid posted_intr_desc_addr, kvm_vcpu_gpa_to_page() fails and nested_get_vmcs12_pages() returns. It doesn't return an error value so vmlaunch proceeds. Note that at this time we have a dangling pointer in vmx->nested.pi_desc and POSTED_INTR_DESC_ADDR in L0's vmcs. 3. Issue an IPI in L2 guest code. This triggers a call to vmx_complete_nested_posted_interrupt() and pi_test_and_clear_on() which dereferences the dangling pointer. Vulnerable code requires nested and enable_apicv variables to be set to true. The host CPU must also support posted interrupts. Fixes: 5e2f30b756a37 "KVM: nVMX: get rid of nested_get_page()" Cc: stable@vger.kernel.org Reviewed-by: Andy Honig Signed-off-by: Cfir Cohen Reviewed-by: Liran Alon Signed-off-by: Paolo Bonzini Signed-off-by: Greg Kroah-Hartman --- arch/x86/kvm/vmx.c | 2 ++ 1 file changed, 2 insertions(+) --- a/arch/x86/kvm/vmx.c +++ b/arch/x86/kvm/vmx.c @@ -10447,6 +10447,8 @@ static void nested_get_vmcs12_pages(stru kunmap(vmx->nested.pi_desc_page); kvm_release_page_dirty(vmx->nested.pi_desc_page); vmx->nested.pi_desc_page = NULL; + vmx->nested.pi_desc = NULL; + vmcs_write64(POSTED_INTR_DESC_ADDR, -1ull); } page = kvm_vcpu_gpa_to_page(vcpu, vmcs12->posted_intr_desc_addr); if (is_error_page(page))