From: Sean Christopherson <seanjc@google.com>
To: Maxim Levitsky <mlevitsk@redhat.com>
Cc: kvm@vger.kernel.org, iommu@lists.linux.dev,
"H. Peter Anvin" <hpa@zytor.com>,
Paolo Bonzini <pbonzini@redhat.com>,
Thomas Gleixner <tglx@linutronix.de>,
Borislav Petkov <bp@alien8.de>, Joerg Roedel <joro@8bytes.org>,
x86@kernel.org,
Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>,
linux-kernel@vger.kernel.org,
Dave Hansen <dave.hansen@linux.intel.com>,
Will Deacon <will@kernel.org>, Ingo Molnar <mingo@redhat.com>,
Robin Murphy <robin.murphy@arm.com>,
stable@vger.kernel.org
Subject: Re: [PATCH v2 1/4] x86: KVM: SVM: always update the x2avic msr interception
Date: Thu, 28 Sep 2023 17:24:18 -0700 [thread overview]
Message-ID: <ZRYZMr4fuaywW7fP@google.com> (raw)
In-Reply-To: <20230928173354.217464-2-mlevitsk@redhat.com>
On Thu, Sep 28, 2023, Maxim Levitsky wrote:
> The following problem exists since x2avic was enabled in the KVM:
>
> svm_set_x2apic_msr_interception is called to enable the interception of
Nit, svm_set_x2apic_msr_interception().
Definitely not worth another version though.
> the x2apic msrs.
>
> In particular it is called at the moment the guest resets its apic.
>
> Assuming that the guest's apic was in x2apic mode, the reset will bring
> it back to the xapic mode.
>
> The svm_set_x2apic_msr_interception however has an erroneous check for
> '!apic_x2apic_mode()' which prevents it from doing anything in this case.
>
> As a result of this, all x2apic msrs are left unintercepted, and that
> exposes the bare metal x2apic (if enabled) to the guest.
> Oops.
>
> Remove the erroneous '!apic_x2apic_mode()' check to fix that.
>
> This fixes CVE-2023-5090
>
> Fixes: 4d1d7942e36a ("KVM: SVM: Introduce logic to (de)activate x2AVIC mode")
> Cc: stable@vger.kernel.org
> Signed-off-by: Maxim Levitsky <mlevitsk@redhat.com>
> ---
Reviewed-by: Sean Christopherson <seanjc@google.com>
next prev parent reply other threads:[~2023-09-29 0:24 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <20230928173354.217464-1-mlevitsk@redhat.com>
2023-09-28 17:33 ` [PATCH v2 1/4] x86: KVM: SVM: always update the x2avic msr interception Maxim Levitsky
2023-09-29 0:24 ` Sean Christopherson [this message]
2023-10-03 3:17 ` Suthikulpanit, Suravee
2023-09-28 17:33 ` [PATCH v2 2/4] x86: KVM: SVM: add support for Invalid IPI Vector interception Maxim Levitsky
2023-09-29 0:42 ` Sean Christopherson
2023-09-28 17:33 ` [PATCH v2 3/4] x86: KVM: SVM: refresh AVIC inhibition in svm_leave_nested() Maxim Levitsky
2023-09-29 0:42 ` Sean Christopherson
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=ZRYZMr4fuaywW7fP@google.com \
--to=seanjc@google.com \
--cc=bp@alien8.de \
--cc=dave.hansen@linux.intel.com \
--cc=hpa@zytor.com \
--cc=iommu@lists.linux.dev \
--cc=joro@8bytes.org \
--cc=kvm@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mingo@redhat.com \
--cc=mlevitsk@redhat.com \
--cc=pbonzini@redhat.com \
--cc=robin.murphy@arm.com \
--cc=stable@vger.kernel.org \
--cc=suravee.suthikulpanit@amd.com \
--cc=tglx@linutronix.de \
--cc=will@kernel.org \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox