On Thu, Nov 02, 2023 at 05:58:15PM +0000, SeongJae Park wrote:
> From: Maxim Levitsky <mlevitsk@xxxxxxxxxx>
>
> The following problem exists since x2avic was enabled in the KVM:
>
> svm_set_x2apic_msr_interception is called to enable the interception of
> the x2apic msrs.
>
> In particular it is called at the moment the guest resets its apic.
>
> Assuming that the guest's apic was in x2apic mode, the reset will bring
> it back to the xapic mode.
>
> The svm_set_x2apic_msr_interception however has an erroneous check for
> '!apic_x2apic_mode()' which prevents it from doing anything in this case.
>
> As a result of this, all x2apic msrs are left unintercepted, and that
> exposes the bare metal x2apic (if enabled) to the guest.
> Oops.
>
> Remove the erroneous '!apic_x2apic_mode()' check to fix that.
>
> This fixes CVE-2023-5090
>
> Fixes: 4d1d7942e36a ("KVM: SVM: Introduce logic to (de)activate x2AVIC mode")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Maxim Levitsky <mlevitsk@xxxxxxxxxx>
> Reviewed-by: Suravee Suthikulpanit <suravee.suthikulpanit@xxxxxxx>
> Tested-by: Suravee Suthikulpanit <suravee.suthikulpanit@xxxxxxx>
> Reviewed-by: Sean Christopherson <seanjc@xxxxxxxxxx>
> Message-Id: <20230928173354.217464-2-mlevitsk@xxxxxxxxxx>
> Signed-off-by: Paolo Bonzini <pbonzini@xxxxxxxxxx>
> (cherry picked from commit b65235f6e102354ccafda601eaa1c5bef5284d21)
> Signed-off-by: SeongJae Park <sj@xxxxxxxxxx>
Now queued up, thanks.
greg k-h
