linux/virt/kvm
Andy Honig a2c118bfab KVM: Fix bounds checking in ioapic indirect register reads (CVE-2013-1798)
If the guest specifies a IOAPIC_REG_SELECT with an invalid value and follows
that with a read of the IOAPIC_REG_WINDOW KVM does not properly validate
that request.  ioapic_read_indirect contains an
ASSERT(redir_index < IOAPIC_NUM_PINS), but the ASSERT has no effect in
non-debug builds.  In recent kernels this allows a guest to cause a kernel
oops by reading invalid memory.  In older kernels (pre-3.3) this allows a
guest to read from large ranges of host memory.

Tested: tested against apic unit tests.

Signed-off-by: Andrew Honig <ahonig@google.com>
Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
2013-03-19 14:20:21 -03:00
..
assigned-dev.c kvm: deliver msi interrupts from irq handler 2012-12-05 15:10:53 +02:00
async_pf.c KVM: do not release the error page 2012-08-06 16:04:58 +03:00
async_pf.h KVM: Halt vcpu if page it tries to access is swapped out 2011-01-12 11:21:39 +02:00
coalesced_mmio.c KVM: make checks stricter in coalesced_mmio_in_range() 2011-12-27 11:17:07 +02:00
coalesced_mmio.h KVM: Make coalesced mmio use a device per zone 2011-09-25 19:17:57 +03:00
eventfd.c hlist: drop the node parameter from iterators 2013-02-27 19:10:24 -08:00
ioapic.c KVM: Fix bounds checking in ioapic indirect register reads (CVE-2013-1798) 2013-03-19 14:20:21 -03:00
ioapic.h x86, apicv: add virtual interrupt delivery support 2013-01-29 10:48:19 +02:00
iodev.h KVM: remove in_range from io devices 2009-09-10 08:33:05 +03:00
iommu.c kvm: Obey read-only mappings in iommu 2013-01-27 12:41:41 +02:00
irq_comm.c hlist: drop the node parameter from iterators 2013-02-27 19:10:24 -08:00
Kconfig KVM: Add config to support ple or cpu relax optimzation 2012-07-23 13:00:53 +03:00
kvm_main.c KVM: Remove user_alloc from struct kvm_memory_slot 2013-02-11 11:52:00 +02:00