Commit fd6fe750 authored by Borislav Petkov (AMD)'s avatar Borislav Petkov (AMD) Committed by openeuler-sync-bot
Browse files

x86/sev: Disable MMIO emulation from user mode

stable inclusion
from stable-v5.10.199
commit d78c5d8c23c3f0e24168ea98760016665bf92a79
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I8BCTB
CVE: CVE-2023-46813

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=d78c5d8c23c3f0e24168ea98760016665bf92a79



--------------------------------

Upstream commit: a37cd2a5

A virt scenario can be constructed where MMIO memory can be user memory.
When that happens, a race condition opens between when the hardware
raises the #VC and when the #VC handler gets to emulate the instruction.

If the MOVS is replaced with a MOVS accessing kernel memory in that
small race window, then write to kernel memory happens as the access
checks are not done at emulation time.

Disable MMIO emulation in user mode temporarily until a sensible use
case appears and justifies properly handling the race window.

Fixes: 0118b604 ("x86/sev-es: Handle MMIO String Instructions")
Reported-by: default avatarTom Dohrmann <erbse.13@gmx.de>
Signed-off-by: default avatarBorislav Petkov (AMD) <bp@alien8.de>
Tested-by: default avatarTom Dohrmann <erbse.13@gmx.de>
Cc: <stable@kernel.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarYu Liao <liaoyu15@huawei.com>
(cherry picked from commit 1b5d336d)
parent 280b1ef6
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please to comment