Unverified Commit b45a4c0d authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!2672 fix CVE-2023-46813 

Merge Pull Request from: @ci-robot 
 
PR sync from: Yu Liao <liaoyu15@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/F5FX4DBY4FGNLQCQ7MNCTCRSKBXESFJA/ 
fix CVE-2023-46813

An issue was discovered in the Linux kernel before 6.5.9, exploitable by local
users with userspace access to MMIO registers. Incorrect access checking in the
#VC handler and instruction emulation of the SEV-ES emulation of MMIO accesses
could lead to arbitrary write access to kernel memory (and thus privilege
escalation). This depends on a race condition through which userspace can
replace an instruction before the #VC handler reads it.

Borislav Petkov (AMD) (1):

Joerg Roedel (2):
  [Backport] x86/sev: Check IOBM for IOIO exceptions from user-space
  [Backport] x86/sev: Check for user-space IOIO pointing to kernel space


-- 
2.25.1
 
https://gitee.com/src-openeuler/kernel/issues/I8BCTB 
 
Link:https://gitee.com/openeuler/kernel/pulls/2672

 

Reviewed-by: default avatarXie XiuQi <xiexiuqi@huawei.com>
Signed-off-by: default avatarJialin Zhang <zhangjialin11@huawei.com>
parents 276d5fca 658245d6

arch/x86/boot/compressed/sev-es.c

+10 −0
Original line number Diff line number Diff line
@@ -106,6 +106,16 @@ static enum es_result vc_read_mem(struct es_em_ctxt *ctxt, 
	return ES_OK;

}



static enum es_result vc_ioio_check(struct es_em_ctxt *ctxt, u16 port, size_t size)

{

	return ES_OK;

}



static bool fault_in_kernel_space(unsigned long address)

{

	return false;

}



#undef __init

#undef __pa

#define __init

arch/x86/kernel/sev-es-shared.c

+44 −9
Original line number Diff line number Diff line
@@ -217,6 +217,23 @@ void __init do_vc_no_ghcb(struct pt_regs *regs, unsigned long exit_code) 
		asm volatile("hlt\n");

}



static enum es_result vc_insn_string_check(struct es_em_ctxt *ctxt,

					   unsigned long address,

					   bool write)

{

	if (user_mode(ctxt->regs) && fault_in_kernel_space(address)) {

		ctxt->fi.vector     = X86_TRAP_PF;

		ctxt->fi.error_code = X86_PF_USER;

		ctxt->fi.cr2        = address;

		if (write)

			ctxt->fi.error_code |= X86_PF_WRITE;



		return ES_EXCEPTION;

	}



	return ES_OK;

}



static enum es_result vc_insn_string_read(struct es_em_ctxt *ctxt,

					  void *src, char *buf,

					  unsigned int data_size,
@@ -224,7 +241,12 @@ static enum es_result vc_insn_string_read(struct es_em_ctxt *ctxt, 
					  bool backwards)

{

	int i, b = backwards ? -1 : 1;

	enum es_result ret = ES_OK;

	unsigned long address = (unsigned long)src;

	enum es_result ret;



	ret = vc_insn_string_check(ctxt, address, false);

	if (ret != ES_OK)

		return ret;



	for (i = 0; i < count; i++) {

		void *s = src + (i * data_size * b);
@@ -245,7 +267,12 @@ static enum es_result vc_insn_string_write(struct es_em_ctxt *ctxt, 
					   bool backwards)

{

	int i, s = backwards ? -1 : 1;

	enum es_result ret = ES_OK;

	unsigned long address = (unsigned long)dst;

	enum es_result ret;



	ret = vc_insn_string_check(ctxt, address, true);

	if (ret != ES_OK)

		return ret;



	for (i = 0; i < count; i++) {

		void *d = dst + (i * data_size * s);
@@ -281,6 +308,9 @@ static enum es_result vc_insn_string_write(struct es_em_ctxt *ctxt, 
static enum es_result vc_ioio_exitinfo(struct es_em_ctxt *ctxt, u64 *exitinfo)

{

	struct insn *insn = &ctxt->insn;

	size_t size;

	u64 port;



	*exitinfo = 0;



	switch (insn->opcode.bytes[0]) {
@@ -289,7 +319,7 @@ static enum es_result vc_ioio_exitinfo(struct es_em_ctxt *ctxt, u64 *exitinfo) 
	case 0x6d:

		*exitinfo |= IOIO_TYPE_INS;

		*exitinfo |= IOIO_SEG_ES;

		*exitinfo |= (ctxt->regs->dx & 0xffff) << 16;

		port	   = ctxt->regs->dx & 0xffff;

		break;



	/* OUTS opcodes */
@@ -297,41 +327,43 @@ static enum es_result vc_ioio_exitinfo(struct es_em_ctxt *ctxt, u64 *exitinfo) 
	case 0x6f:

		*exitinfo |= IOIO_TYPE_OUTS;

		*exitinfo |= IOIO_SEG_DS;

		*exitinfo |= (ctxt->regs->dx & 0xffff) << 16;

		port	   = ctxt->regs->dx & 0xffff;

		break;



	/* IN immediate opcodes */

	case 0xe4:

	case 0xe5:

		*exitinfo |= IOIO_TYPE_IN;

		*exitinfo |= (u8)insn->immediate.value << 16;

		port	   = (u8)insn->immediate.value & 0xffff;

		break;



	/* OUT immediate opcodes */

	case 0xe6:

	case 0xe7:

		*exitinfo |= IOIO_TYPE_OUT;

		*exitinfo |= (u8)insn->immediate.value << 16;

		port	   = (u8)insn->immediate.value & 0xffff;

		break;



	/* IN register opcodes */

	case 0xec:

	case 0xed:

		*exitinfo |= IOIO_TYPE_IN;

		*exitinfo |= (ctxt->regs->dx & 0xffff) << 16;

		port	   = ctxt->regs->dx & 0xffff;

		break;



	/* OUT register opcodes */

	case 0xee:

	case 0xef:

		*exitinfo |= IOIO_TYPE_OUT;

		*exitinfo |= (ctxt->regs->dx & 0xffff) << 16;

		port	   = ctxt->regs->dx & 0xffff;

		break;



	default:

		return ES_DECODE_FAILED;

	}



	*exitinfo |= port << 16;



	switch (insn->opcode.bytes[0]) {

	case 0x6c:

	case 0x6e:
@@ -341,12 +373,15 @@ static enum es_result vc_ioio_exitinfo(struct es_em_ctxt *ctxt, u64 *exitinfo) 
	case 0xee:

		/* Single byte opcodes */

		*exitinfo |= IOIO_DATA_8;

		size       = 1;

		break;

	default:

		/* Length determined by instruction parsing */

		*exitinfo |= (insn->opnd_bytes == 2) ? IOIO_DATA_16

						     : IOIO_DATA_32;

		size       = (insn->opnd_bytes == 2) ? 2 : 4;

	}



	switch (insn->addr_bytes) {

	case 2:

		*exitinfo |= IOIO_ADDR_16;
@@ -362,7 +397,7 @@ static enum es_result vc_ioio_exitinfo(struct es_em_ctxt *ctxt, u64 *exitinfo) 
	if (insn_has_rep_prefix(insn))

		*exitinfo |= IOIO_REP;



	return ES_OK;

	return vc_ioio_check(ctxt, (u16)port, size);

}



static enum es_result vc_handle_ioio(struct ghcb *ghcb, struct es_em_ctxt *ctxt)

arch/x86/kernel/sev-es.c

+30 −0
Original line number Diff line number Diff line
@@ -448,6 +448,33 @@ static enum es_result vc_slow_virt_to_phys(struct ghcb *ghcb, struct es_em_ctxt 
	return ES_OK;

}



static enum es_result vc_ioio_check(struct es_em_ctxt *ctxt, u16 port, size_t size)

{

	BUG_ON(size > 4);



	if (user_mode(ctxt->regs)) {

		struct thread_struct *t = &current->thread;

		struct io_bitmap *iobm = t->io_bitmap;

		size_t idx;



		if (!iobm)

			goto fault;



		for (idx = port; idx < port + size; ++idx) {

			if (test_bit(idx, iobm->bitmap))

				goto fault;

		}

	}



	return ES_OK;



fault:

	ctxt->fi.vector = X86_TRAP_GP;

	ctxt->fi.error_code = 0;



	return ES_EXCEPTION;

}



/* Include code shared with pre-decompression boot stage */

#include "sev-es-shared.c"
@@ -970,6 +997,9 @@ static enum es_result vc_handle_mmio(struct ghcb *ghcb, 
	enum es_result ret;

	long *reg_data;



	if (user_mode(ctxt->regs))

		return ES_UNSUPPORTED;



	switch (insn->opcode.bytes[0]) {

	/* MMIO Write */

	case 0x88: