diff options
| author | Andy Honig <ahonig@google.com> | 2013-02-20 14:48:10 -0800 |
|---|---|---|
| committer | Ben Hutchings <ben@decadent.org.uk> | 2013-04-25 20:25:50 +0100 |
| commit | 767d3d43c0a02485a8574c0efe39524f246d698b (patch) | |
| tree | cf6c841331537c2760b340faa1f552d02f14d622 /net/ipv4 | |
| parent | b7c5ee6d49b7cf5a52ae87b955d7ab984cb9c974 (diff) | |
| download | linux-stable-767d3d43c0a02485a8574c0efe39524f246d698b.tar.gz linux-stable-767d3d43c0a02485a8574c0efe39524f246d698b.tar.bz2 linux-stable-767d3d43c0a02485a8574c0efe39524f246d698b.zip | |
KVM: x86: Convert MSR_KVM_SYSTEM_TIME to use gfn_to_hva_cache functions (CVE-2013-1797)
commit 0b79459b482e85cb7426aa7da683a9f2c97aeae1 upstream.
There is a potential use after free issue with the handling of
MSR_KVM_SYSTEM_TIME. If the guest specifies a GPA in a movable or removable
memory such as frame buffers then KVM might continue to write to that
address even after it's removed via KVM_SET_USER_MEMORY_REGION. KVM pins
the page in memory so it's unlikely to cause an issue, but if the user
space component re-purposes the memory previously used for the guest, then
the guest will be able to corrupt that memory.
Tested: Tested against kvmclock unit test
Signed-off-by: Andrew Honig <ahonig@google.com>
Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
[bwh: Backported to 3.2:
- Adjust context
- We do not implement the PVCLOCK_GUEST_STOPPED flag]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Diffstat (limited to 'net/ipv4')
0 files changed, 0 insertions, 0 deletions