Date: Tue, 15 Sep 2020 21:04:28 +0000 (UTC) From: Ed Maste <emaste@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r365775 - in head/sys/amd64/vmm: amd intel Message-ID: <202009152104.08FL4SrA021951@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: emaste Date: Tue Sep 15 21:04:27 2020 New Revision: 365775 URL: https://svnweb.freebsd.org/changeset/base/365775 Log: bhyve: do not permit write access to VMCB / VMCS Reported by: Patrick Mooney Submitted by: jhb Security: CVE-2020-24718 Modified: head/sys/amd64/vmm/amd/svm.c head/sys/amd64/vmm/intel/vmx.c Modified: head/sys/amd64/vmm/amd/svm.c ============================================================================== --- head/sys/amd64/vmm/amd/svm.c Tue Sep 15 21:00:25 2020 (r365774) +++ head/sys/amd64/vmm/amd/svm.c Tue Sep 15 21:04:27 2020 (r365775) @@ -2227,8 +2227,11 @@ svm_setreg(void *arg, int vcpu, int ident, uint64_t va return (svm_modify_intr_shadow(svm_sc, vcpu, val)); } - if (vmcb_write(svm_sc, vcpu, ident, val) == 0) { - return (0); + /* Do not permit user write access to VMCB fields by offset. */ + if (!VMCB_ACCESS_OK(ident)) { + if (vmcb_write(svm_sc, vcpu, ident, val) == 0) { + return (0); + } } reg = swctx_regptr(svm_get_guest_regctx(svm_sc, vcpu), ident); Modified: head/sys/amd64/vmm/intel/vmx.c ============================================================================== --- head/sys/amd64/vmm/intel/vmx.c Tue Sep 15 21:00:25 2020 (r365774) +++ head/sys/amd64/vmm/intel/vmx.c Tue Sep 15 21:04:27 2020 (r365775) @@ -3341,6 +3341,10 @@ vmx_setreg(void *arg, int vcpu, int reg, uint64_t val) if (vmxctx_setreg(&vmx->ctx[vcpu], reg, val) == 0) return (0); + /* Do not permit user write access to VMCS fields by offset. */ + if (reg < 0) + return (EINVAL); + error = vmcs_setreg(&vmx->vmcs[vcpu], running, reg, val); if (error == 0) {
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202009152104.08FL4SrA021951>