Andy Honig 0b79459b48 KVM: x86: Convert MSR_KVM_SYSTEM_TIME to use gfn_to_hva_cache functions (CVE-2013-1797) ...

There is a potential use after free issue with the handling of
MSR_KVM_SYSTEM_TIME.  If the guest specifies a GPA in a movable or removable
memory such as frame buffers then KVM might continue to write to that
address even after it's removed via KVM_SET_USER_MEMORY_REGION.  KVM pins
the page in memory so it's unlikely to cause an issue, but if the user
space component re-purposes the memory previously used for the guest, then
the guest will be able to corrupt that memory.

Tested: Tested against kvmclock unit test

Signed-off-by: Andrew Honig <ahonig@google.com>
Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>

2013-03-19 14:17:35 -03:00

..

cpuid.c

KVM: x86: Make register state after reset conform to specification

2012-12-05 18:00:07 +02:00

cpuid.h

Merge tag 'kvm-3.8-1' of git://git.kernel.org/pub/scm/virt/kvm/kvm

2012-12-13 15:31:08 -08:00

emulate.c

x86 emulator: fix parity calculation for AAD instruction

2013-02-13 18:01:00 +02:00

i8254.c

kvm: fix i8254 counter 0 wraparound

2012-12-18 11:12:38 +02:00

i8254.h

KVM: fold kvm_pit_timer into kvm_kpit_state

2012-08-01 00:21:07 -03:00

i8259.c

KVM: inject ExtINT interrupt before APIC interrupts

2012-12-13 23:05:21 -02:00

irq.c

x86, apicv: add virtual interrupt delivery support

2013-01-29 10:48:19 +02:00

irq.h

KVM: switch to symbolic name for irq_states size

2012-07-20 16:12:16 -03:00

Kconfig

KVM: Depend on HIGH_RES_TIMERS

2012-09-10 11:10:03 +03:00

kvm_cache_regs.h

KVM: MMU: Do not unconditionally read PDPTE from guest memory

2011-09-25 19:18:01 +03:00

lapic.c

x86, apicv: add virtual interrupt delivery support

2013-01-29 10:48:19 +02:00

lapic.h

x86, apicv: add virtual interrupt delivery support

2013-01-29 10:48:19 +02:00

Makefile

KVM: Remove internal timer abstraction

2012-08-01 00:21:06 -03:00

mmu_audit.c

KVM: do not release the error pfn

2012-08-06 16:04:57 +03:00

mmu.c

hlist: drop the node parameter from iterators

2013-02-27 19:10:24 -08:00

mmu.h

KVM: MMU: Optimize is_last_gpte()

2012-09-20 13:00:09 +03:00

mmutrace.h

KVM: mmu: remove unused trace event

2013-01-07 19:54:50 -02:00

paging_tmpl.h

KVM: MMU: remove pt_access in mmu_set_spte

2013-02-06 22:42:08 -02:00

pmu.c

Merge branch 'queue' into next

2012-07-26 11:54:21 +03:00

svm.c

x86, apicv: add virtual interrupt delivery support

2013-01-29 10:48:19 +02:00

trace.h

KVM: x86: require matched TSC offsets for master clock

2012-11-27 23:29:15 -02:00

tss.h

KVM: x86: hardware task switching support

2008-04-27 12:00:39 +03:00

vmx.c

KVM: nVMX: Remove redundant get_vmcs12 from nested_vmx_exit_handled_msr

2013-02-14 10:35:16 +02:00

x86.c

KVM: x86: Convert MSR_KVM_SYSTEM_TIME to use gfn_to_hva_cache functions (CVE-2013-1797)

2013-03-19 14:17:35 -03:00

x86.h

KVM: x86: Add code to track call origin for msr assignment

2012-11-30 18:26:12 -02:00