| From d9092f52d7e61dd1557f2db2400ddb430e85937e Mon Sep 17 00:00:00 2001 |
| From: Owen Hofmann <osh@google.com> |
| Date: Thu, 27 Oct 2016 11:25:52 -0700 |
| Subject: kvm: x86: Check memopp before dereference (CVE-2016-8630) |
| |
| From: Owen Hofmann <osh@google.com> |
| |
| commit d9092f52d7e61dd1557f2db2400ddb430e85937e upstream. |
| |
| Commit 41061cdb98 ("KVM: emulate: do not initialize memopp") removes a |
| check for non-NULL under incorrect assumptions. An undefined instruction |
| with a ModR/M byte with Mod=0 and R/M-5 (e.g. 0xc7 0x15) will attempt |
| to dereference a null pointer here. |
| |
| Fixes: 41061cdb98a0bec464278b4db8e894a3121671f5 |
| Message-Id: <1477592752-126650-2-git-send-email-osh@google.com> |
| Signed-off-by: Owen Hofmann <osh@google.com> |
| Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| |
| --- |
| arch/x86/kvm/emulate.c | 2 +- |
| 1 file changed, 1 insertion(+), 1 deletion(-) |
| |
| --- a/arch/x86/kvm/emulate.c |
| +++ b/arch/x86/kvm/emulate.c |
| @@ -5045,7 +5045,7 @@ done_prefixes: |
| /* Decode and fetch the destination operand: register or memory. */ |
| rc = decode_operand(ctxt, &ctxt->dst, (ctxt->d >> DstShift) & OpMask); |
| |
| - if (ctxt->rip_relative) |
| + if (ctxt->rip_relative && likely(ctxt->memopp)) |
| ctxt->memopp->addr.mem.ea = address_mask(ctxt, |
| ctxt->memopp->addr.mem.ea + ctxt->_eip); |
| |
