diff options
| author | Jan Beulich <JBeulich@suse.com> | 2012-06-12 11:33:40 +0100 |
|---|---|---|
| committer | Jan Beulich <JBeulich@suse.com> | 2012-06-12 11:33:40 +0100 |
| commit | 6b091fa4457c6768c7fc505e2a42a5f32b83bc8d (patch) | |
| tree | d9e28e6b02e96671154a7ece509c246c02ce18cb /xen/arch/x86/x86_64 | |
| parent | 46fce9fd2b3557c97e6ce9beec9ed17ad87d6f94 (diff) | |
| download | xen-6b091fa4457c6768c7fc505e2a42a5f32b83bc8d.tar.gz xen-6b091fa4457c6768c7fc505e2a42a5f32b83bc8d.tar.bz2 xen-6b091fa4457c6768c7fc505e2a42a5f32b83bc8d.zip | |
x86_64: Do not execute sysret with a non-canonical return address
Check for non-canonical guest RIP before attempting to execute sysret.
If sysret is executed with a non-canonical value in RCX, Intel CPUs
take the fault in ring0, but we will necessarily already have switched
to the the user's stack pointer.
This is a security vulnerability, XSA-7 / CVE-2012-0217.
Signed-off-by: Jan Beulich <JBeulich@suse.com>
Signed-off-by: Ian Campbell <Ian.Campbell@citrix.com>
Signed-off-by: Ian Jackson <ian.jackson@eu.citrix.com>
Tested-by: Ian Campbell <Ian.Campbell@citrix.com>
Acked-by: Keir Fraser <keir.xen@gmail.com>
Committed-by: Ian Jackson <ian.jackson@eu.citrix.com>
Diffstat (limited to 'xen/arch/x86/x86_64')
| -rw-r--r-- | xen/arch/x86/x86_64/entry.S | 11 |
1 files changed, 11 insertions, 0 deletions
diff --git a/xen/arch/x86/x86_64/entry.S b/xen/arch/x86/x86_64/entry.S index 3836260b9a..3204479503 100644 --- a/xen/arch/x86/x86_64/entry.S +++ b/xen/arch/x86/x86_64/entry.S @@ -40,6 +40,13 @@ restore_all_guest: testw $TRAP_syscall,4(%rsp) jz iret_exit_to_guest + /* Don't use SYSRET path if the return address is not canonical. */ + movq 8(%rsp),%rcx + sarq $47,%rcx + incl %ecx + cmpl $1,%ecx + ja .Lforce_iret + addq $8,%rsp popq %rcx # RIP popq %r11 # CS @@ -50,6 +57,10 @@ restore_all_guest: sysretq 1: sysretl +.Lforce_iret: + /* Mimic SYSRET behavior. */ + movq 8(%rsp),%rcx # RIP + movq 24(%rsp),%r11 # RFLAGS ALIGN /* No special register assumptions. */ iret_exit_to_guest: |