This is a note to let you know that I've just added the patch titled
KVM: emulate: avoid accessing NULL ctxt->memopp
to the 3.17-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
kvm-emulate-avoid-accessing-null-ctxt-memopp.patch
and it can be found in the queue-3.17 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From a430c9166312e1aa3d80bce32374233bdbfeba32 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@xxxxxxxxxx>
Date: Thu, 23 Oct 2014 14:54:14 +0200
Subject: KVM: emulate: avoid accessing NULL ctxt->memopp
From: Paolo Bonzini <pbonzini@xxxxxxxxxx>
commit a430c9166312e1aa3d80bce32374233bdbfeba32 upstream.
A failure to decode the instruction can cause a NULL pointer access.
This is fixed simply by moving the "done" label as close as possible
to the return.
This fixes CVE-2014-8481.
Reported-by: Andy Lutomirski <luto@xxxxxxxxxxxxxx>
Fixes: 41061cdb98a0bec464278b4db8e894a3121671f5
Signed-off-by: Paolo Bonzini <pbonzini@xxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
arch/x86/kvm/emulate.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/x86/kvm/emulate.c
+++ b/arch/x86/kvm/emulate.c
@@ -4481,10 +4481,10 @@ done_prefixes:
/* Decode and fetch the destination operand: register or memory. */
rc = decode_operand(ctxt, &ctxt->dst, (ctxt->d >> DstShift) & OpMask);
-done:
if (ctxt->rip_relative)
ctxt->memopp->addr.mem.ea += ctxt->_eip;
+done:
return (rc != X86EMUL_CONTINUE) ? EMULATION_FAILED : EMULATION_OK;
}
Patches currently in stable-queue which might be from pbonzini@xxxxxxxxxx are
queue-3.17/kvm-x86-emulator-fixes-for-eip-canonical-checks-on-near-branches.patch
queue-3.17/kvm-vmx-handle-invvpid-vm-exit-gracefully.patch
queue-3.17/kvm-x86-prevent-host-from-panicking-on-shared-msr-writes.patch
queue-3.17/kvm-x86-check-non-canonical-addresses-upon-wrmsr.patch
queue-3.17/kvm-x86-handle-errors-when-rip-is-set-during-far-jumps.patch
queue-3.17/kvm-emulator-fix-execution-close-to-the-segment-limit.patch
queue-3.17/kvm-x86-don-t-kill-guest-on-unknown-exit-reason.patch
queue-3.17/kvm-x86-improve-thread-safety-in-pit.patch
queue-3.17/kvm-emulate-avoid-accessing-null-ctxt-memopp.patch
queue-3.17/kvm-x86-emulator-does-not-decode-clflush-well.patch
queue-3.17/kvm-fix-excessive-pages-un-pinning-in-kvm_iommu_map-error-path.patch
queue-3.17/kvm-x86-prefetch-and-hint_nop-should-have-srcmem-flag.patch
queue-3.17/kvm-x86-fix-wrong-masking-on-relative-jump-call.patch
queue-3.17/kvm-x86-decoding-guest-instructions-which-cross-page-boundary-may-fail.patch
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html