| From 51aa68e7d57e3217192d88ce90fd5b8ef29ec94f Mon Sep 17 00:00:00 2001 |
| From: Jim Mattson <jmattson@google.com> |
| Date: Tue, 12 Sep 2017 13:02:54 -0700 |
| Subject: kvm: nVMX: Don't allow L2 to access the hardware CR8 |
| |
| From: Jim Mattson <jmattson@google.com> |
| |
| commit 51aa68e7d57e3217192d88ce90fd5b8ef29ec94f upstream. |
| |
| If L1 does not specify the "use TPR shadow" VM-execution control in |
| vmcs12, then L0 must specify the "CR8-load exiting" and "CR8-store |
| exiting" VM-execution controls in vmcs02. Failure to do so will give |
| the L2 VM unrestricted read/write access to the hardware CR8. |
| |
| This fixes CVE-2017-12154. |
| |
| Signed-off-by: Jim Mattson <jmattson@google.com> |
| Reviewed-by: David Hildenbrand <david@redhat.com> |
| Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| |
| --- |
| arch/x86/kvm/vmx.c | 5 +++++ |
| 1 file changed, 5 insertions(+) |
| |
| --- a/arch/x86/kvm/vmx.c |
| +++ b/arch/x86/kvm/vmx.c |
| @@ -8275,6 +8275,11 @@ static void prepare_vmcs02(struct kvm_vc |
| vmcs_write64(VIRTUAL_APIC_PAGE_ADDR, |
| page_to_phys(vmx->nested.virtual_apic_page)); |
| vmcs_write32(TPR_THRESHOLD, vmcs12->tpr_threshold); |
| + } else { |
| +#ifdef CONFIG_X86_64 |
| + exec_control |= CPU_BASED_CR8_LOAD_EXITING | |
| + CPU_BASED_CR8_STORE_EXITING; |
| +#endif |
| } |
| |
| /* |
