From 00330de0073ca61fa45bd800df2cc4f4a947cbc9 Mon Sep 17 00:00:00 2001 From: Jan Beulich Date: Tue, 12 Jun 2012 11:38:31 +0100 Subject: x86_64: Do not execute sysret with a non-canonical return address Check for non-canonical guest RIP before attempting to execute sysret. If sysret is executed with a non-canonical value in RCX, Intel CPUs take the fault in ring0, but we will necessarily already have switched to the the user's stack pointer. This is a security vulnerability, XSA-7 / CVE-2012-0217. Signed-off-by: Jan Beulich Signed-off-by: Ian Campbell Signed-off-by: Ian Jackson Acked-by: Keir Fraser Committed-by: Ian Jackson xen-unstable changeset: 25480:76eaf5966c05 xen-unstable date: Tue Jun 12 11:33:40 2012 +0100 Committed-by: Ian Jackson --- xen/arch/x86/x86_64/entry.S | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/xen/arch/x86/x86_64/entry.S b/xen/arch/x86/x86_64/entry.S index e6483f15db..f42630f2dc 100644 --- a/xen/arch/x86/x86_64/entry.S +++ b/xen/arch/x86/x86_64/entry.S @@ -51,6 +51,13 @@ restore_all_guest: testw $TRAP_syscall,4(%rsp) jz iret_exit_to_guest + /* Don't use SYSRET path if the return address is not canonical. */ + movq 8(%rsp),%rcx + sarq $47,%rcx + incl %ecx + cmpl $1,%ecx + ja .Lforce_iret + addq $8,%rsp popq %rcx # RIP popq %r11 # CS @@ -61,6 +68,10 @@ restore_all_guest: sysretq 1: sysretl +.Lforce_iret: + /* Mimic SYSRET behavior. */ + movq 8(%rsp),%rcx # RIP + movq 24(%rsp),%r11 # RFLAGS ALIGN /* No special register assumptions. */ iret_exit_to_guest: -- cgit v1.2.3