diff options
| author | Andy Honig <ahonig@google.com> | 2013-02-20 14:48:10 -0800 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2013-04-25 21:23:48 -0700 |
| commit | df0ed3450c217a1cd571c0d4efa4dc6c458894a9 (patch) | |
| tree | 6498680c464a42e6b54f34f47f030ac0c0e6a64f /virt | |
| parent | d7709255affba50d2ff4087d28308e03d1154afa (diff) | |
| download | kernel_samsung_smdk4412-df0ed3450c217a1cd571c0d4efa4dc6c458894a9.zip kernel_samsung_smdk4412-df0ed3450c217a1cd571c0d4efa4dc6c458894a9.tar.gz kernel_samsung_smdk4412-df0ed3450c217a1cd571c0d4efa4dc6c458894a9.tar.bz2 | |
KVM: x86: Convert MSR_KVM_SYSTEM_TIME to use gfn_to_hva_cache functions (CVE-2013-1797)
commit 0b79459b482e85cb7426aa7da683a9f2c97aeae1 upstream.
There is a potential use after free issue with the handling of
MSR_KVM_SYSTEM_TIME. If the guest specifies a GPA in a movable or removable
memory such as frame buffers then KVM might continue to write to that
address even after it's removed via KVM_SET_USER_MEMORY_REGION. KVM pins
the page in memory so it's unlikely to cause an issue, but if the user
space component re-purposes the memory previously used for the guest, then
the guest will be able to corrupt that memory.
Tested: Tested against kvmclock unit test
Signed-off-by: Andrew Honig <ahonig@google.com>
Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
Cc: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'virt')
0 files changed, 0 insertions, 0 deletions