From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CF9A4127E20 for ; Tue, 21 May 2024 14:20:28 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1716301229; cv=none; b=UdEUsyPBS+xvxDOsm9lkxevunzkqFBYfV8tnU+5v+pPa+t5dwLb3ZiLAGwdTme3M0HRpTusjgH8D3/l1iKlLDIFxyajy/ArzzfRdXAZSWdMHSle3I+e5Aa/9nK7ZIhXIXjCwdHp5q3G4sJkbSdSSik/WQnUFXiG2TEtiOh8ssgo= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1716301229; c=relaxed/simple; bh=jgK9v8GYAWrbtuhWNq7cp6zYf7or/EXLWAJBh26Zqjg=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=rEqdiRge/q9Au/FzmfS8Y+rvrN1gxOcN21Dj7fiG9tmCwQ+9CbNRItGpMAKKP+GKqc514hMHF7ppxEu9ov4bjWs51KwkGmeD1gm3bMTcsg1fsxILH1rY5lDDtmuTyosgg7dm0cCC1B6yBatixKfK2FVZS/k1Y+8vyIOE2TyRb7k= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=mqycVzU6; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="mqycVzU6" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 04C90C2BD11; Tue, 21 May 2024 14:20:27 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1716301228; bh=jgK9v8GYAWrbtuhWNq7cp6zYf7or/EXLWAJBh26Zqjg=; h=From:To:Cc:Subject:Date:Reply-to:From; b=mqycVzU6NgOFFcI7jB+toCYINGtmocf6mSz1ednomz1CA67IvRJ4W6ptEIo+UCfe+ 411psrLF9rGdwvjtY0bTckGYeCaPsSeMF+QZ/TcZlOM3AY882AkNaGeEu4awDh0XlF SMuRdSDJ4t/gqjzVnHRjZ9/Ymva5bhUaOvGBn47w= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2021-47230: KVM: x86: Immediately reset the MMU context when the SMM flag is cleared Date: Tue, 21 May 2024 16:19:44 +0200 Message-ID: <2024052138-CVE-2021-47230-e1ff@gregkh> X-Mailer: git-send-email 2.45.1 Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Reply-to: , X-Developer-Signature: v=1; a=openpgp-sha256; l=4942; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=jgK9v8GYAWrbtuhWNq7cp6zYf7or/EXLWAJBh26Zqjg=; b=owGbwMvMwCRo6H6F97bub03G02pJDGk+a6u4zf+6Lw97WHoiytP28JU5X18WtzQLOlV1b158K lf2b7pfRywLgyATg6yYIsuXbTxH91ccUvQytD0NM4eVCWQIAxenAEzEPp9hnnWZ4DVR44Nv3zV/ Wfuu/cWxZXWMjAwLJserzJ5lHLJFROt+7OI/uu9ni/06CAA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit Description =========== In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Immediately reset the MMU context when the SMM flag is cleared Immediately reset the MMU context when the vCPU's SMM flag is cleared so that the SMM flag in the MMU role is always synchronized with the vCPU's flag. If RSM fails (which isn't correctly emulated), KVM will bail without calling post_leave_smm() and leave the MMU in a bad state. The bad MMU role can lead to a NULL pointer dereference when grabbing a shadow page's rmap for a page fault as the initial lookups for the gfn will happen with the vCPU's SMM flag (=0), whereas the rmap lookup will use the shadow page's SMM flag, which comes from the MMU (=1). SMM has an entirely different set of memslots, and so the initial lookup can find a memslot (SMM=0) and then explode on the rmap memslot lookup (SMM=1). general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] CPU: 1 PID: 8410 Comm: syz-executor382 Not tainted 5.13.0-rc5-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:__gfn_to_rmap arch/x86/kvm/mmu/mmu.c:935 [inline] RIP: 0010:gfn_to_rmap+0x2b0/0x4d0 arch/x86/kvm/mmu/mmu.c:947 Code: <42> 80 3c 20 00 74 08 4c 89 ff e8 f1 79 a9 00 4c 89 fb 4d 8b 37 44 RSP: 0018:ffffc90000ffef98 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff888015b9f414 RCX: ffff888019669c40 RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000001 RBP: 0000000000000001 R08: ffffffff811d9cdb R09: ffffed10065a6002 R10: ffffed10065a6002 R11: 0000000000000000 R12: dffffc0000000000 R13: 0000000000000003 R14: 0000000000000001 R15: 0000000000000000 FS: 000000000124b300(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 0000000028e31000 CR4: 00000000001526e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: rmap_add arch/x86/kvm/mmu/mmu.c:965 [inline] mmu_set_spte+0x862/0xe60 arch/x86/kvm/mmu/mmu.c:2604 __direct_map arch/x86/kvm/mmu/mmu.c:2862 [inline] direct_page_fault+0x1f74/0x2b70 arch/x86/kvm/mmu/mmu.c:3769 kvm_mmu_do_page_fault arch/x86/kvm/mmu.h:124 [inline] kvm_mmu_page_fault+0x199/0x1440 arch/x86/kvm/mmu/mmu.c:5065 vmx_handle_exit+0x26/0x160 arch/x86/kvm/vmx/vmx.c:6122 vcpu_enter_guest+0x3bdd/0x9630 arch/x86/kvm/x86.c:9428 vcpu_run+0x416/0xc20 arch/x86/kvm/x86.c:9494 kvm_arch_vcpu_ioctl_run+0x4e8/0xa40 arch/x86/kvm/x86.c:9722 kvm_vcpu_ioctl+0x70f/0xbb0 arch/x86/kvm/../../../virt/kvm/kvm_main.c:3460 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:1069 [inline] __se_sys_ioctl+0xfb/0x170 fs/ioctl.c:1055 do_syscall_64+0x3f/0xb0 arch/x86/entry/common.c:47 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x440ce9 The Linux kernel CVE team has assigned CVE-2021-47230 to this issue. Affected and fixed versions =========================== Issue introduced in 5.1 with commit 9ec19493fb86 and fixed in 5.4.128 with commit cbb425f62df9 Issue introduced in 5.1 with commit 9ec19493fb86 and fixed in 5.10.46 with commit 669a8866e468 Issue introduced in 5.1 with commit 9ec19493fb86 and fixed in 5.12.13 with commit df9a40cfb3be Issue introduced in 5.1 with commit 9ec19493fb86 and fixed in 5.13 with commit 78fcb2c91adf Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2021-47230 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: arch/x86/kvm/x86.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/cbb425f62df9df7abee4b3f068f7ed6ffc3561e2 https://git.kernel.org/stable/c/669a8866e468fd020d34eb00e08cb41d3774b71b https://git.kernel.org/stable/c/df9a40cfb3be2cbeb1c17bb67c59251ba16630f3 https://git.kernel.org/stable/c/78fcb2c91adfec8ce3a2ba6b4d0dda89f2f4a7c6