linux-stable

mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2025-01-09 14:43:16 +00:00

History

Andy Honig a2c118bfab KVM: Fix bounds checking in ioapic indirect register reads (CVE-2013-1798)

If the guest specifies a IOAPIC_REG_SELECT with an invalid value and follows
that with a read of the IOAPIC_REG_WINDOW KVM does not properly validate
that request.  ioapic_read_indirect contains an
ASSERT(redir_index < IOAPIC_NUM_PINS), but the ASSERT has no effect in
non-debug builds.  In recent kernels this allows a guest to cause a kernel
oops by reading invalid memory.  In older kernels (pre-3.3) this allows a
guest to read from large ranges of host memory.

Tested: tested against apic unit tests.

Signed-off-by: Andrew Honig <ahonig@google.com>
Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>

2013-03-19 14:20:21 -03:00

assigned-dev.c

kvm: deliver msi interrupts from irq handler

2012-12-05 15:10:53 +02:00

async_pf.c

KVM: do not release the error page

2012-08-06 16:04:58 +03:00

async_pf.h

KVM: Halt vcpu if page it tries to access is swapped out

2011-01-12 11:21:39 +02:00

coalesced_mmio.c

KVM: make checks stricter in coalesced_mmio_in_range()