diff options
| author | Jan Beulich <JBeulich@suse.com> | 2012-06-12 11:38:31 +0100 |
|---|---|---|
| committer | Jan Beulich <JBeulich@suse.com> | 2012-06-12 11:38:31 +0100 |
| commit | 00330de0073ca61fa45bd800df2cc4f4a947cbc9 (patch) | |
| tree | f76cc8eaa9c6a6e7a306e86c5c07da23101c043b | |
| parent | 9dc1e494c80cfcc7114826e582e733c551968a55 (diff) | |
| download | xen-00330de0073ca61fa45bd800df2cc4f4a947cbc9.tar.gz xen-00330de0073ca61fa45bd800df2cc4f4a947cbc9.tar.bz2 xen-00330de0073ca61fa45bd800df2cc4f4a947cbc9.zip | |
x86_64: Do not execute sysret with a non-canonical return address
Check for non-canonical guest RIP before attempting to execute sysret.
If sysret is executed with a non-canonical value in RCX, Intel CPUs
take the fault in ring0, but we will necessarily already have switched
to the the user's stack pointer.
This is a security vulnerability, XSA-7 / CVE-2012-0217.
Signed-off-by: Jan Beulich <JBeulich@suse.com>
Signed-off-by: Ian Campbell <Ian.Campbell@citrix.com>
Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com>
Acked-by: Keir Fraser <keir.xen@gmail.com>
Committed-by: Ian Jackson <ian.jackson@eu.citrix.com>
xen-unstable changeset: 25480:76eaf5966c05
xen-unstable date: Tue Jun 12 11:33:40 2012 +0100
Committed-by: Ian Jackson <ian.jackson@eu.citrix.com>
| -rw-r--r-- | xen/arch/x86/x86_64/entry.S | 11 |
1 files changed, 11 insertions, 0 deletions
diff --git a/xen/arch/x86/x86_64/entry.S b/xen/arch/x86/x86_64/entry.S index e6483f15db..f42630f2dc 100644 --- a/xen/arch/x86/x86_64/entry.S +++ b/xen/arch/x86/x86_64/entry.S @@ -51,6 +51,13 @@ restore_all_guest: testw $TRAP_syscall,4(%rsp) jz iret_exit_to_guest + /* Don't use SYSRET path if the return address is not canonical. */ + movq 8(%rsp),%rcx + sarq $47,%rcx + incl %ecx + cmpl $1,%ecx + ja .Lforce_iret + addq $8,%rsp popq %rcx # RIP popq %r11 # CS @@ -61,6 +68,10 @@ restore_all_guest: sysretq 1: sysretl +.Lforce_iret: + /* Mimic SYSRET behavior. */ + movq 8(%rsp),%rcx # RIP + movq 24(%rsp),%r11 # RFLAGS ALIGN /* No special register assumptions. */ iret_exit_to_guest: |