Skip to content

Potential Vulnerability in Cloned Code #24

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
pr-hung wants to merge 1 commit into
base: master
Choose a base branch
from
Draft

Potential Vulnerability in Cloned Code #24

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 15 additions & 0 deletions arch/x86/kvm/emulate.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1736,20 +1736,35 @@ static int load_segment_descriptor(struct x86_emulate_ctxt *ctxt,
{
u8 cpl = ctxt->ops->cpl(ctxt);


/*
/*
* None of MOV, POP and LSS can load a NULL selector in CPL=3, but
* None of MOV, POP and LSS can load a NULL selector in CPL=3, but
* they can load it at CPL<3 (Intel's manual says only LSS can,
* they can load it at CPL<3 (Intel's manual says only LSS can,
* but it's wrong).
* but it's wrong).
*
*
* However, the Intel manual says that putting IST=1/DPL=3 in
* However, the Intel manual says that putting IST=1/DPL=3 in
* an interrupt gate will result in SS=3 (the AMD manual instead
* an interrupt gate will result in SS=3 (the AMD manual instead
* says it doesn't), so allow SS=3 in __load_segment_descriptor
* says it doesn't), so allow SS=3 in __load_segment_descriptor
* and only forbid it here.
* and only forbid it here.
*/
*/
if (seg == VCPU_SREG_SS && selector == 3 &&
if (seg == VCPU_SREG_SS && selector == 3 &&
ctxt->mode == X86EMUL_MODE_PROT64)
ctxt->mode == X86EMUL_MODE_PROT64)
return emulate_exception(ctxt, GP_VECTOR, 0, true);
return emulate_exception(ctxt, GP_VECTOR, 0, true);


return __load_segment_descriptor(ctxt, selector, seg, cpl,
X86_TRANSFER_NONE, NULL);
}
Expand Down