x86/sev: Check for user-space IOIO pointing to kernel space
[ upstream commit 63e44bc52047f182601e7817da969a105aa1f721 ]
Check the memory operand of INS/OUTS before emulating the instruction.
The #VC exception can get raised from user-space, but the memory operand
can be manipulated to access kernel memory before the emulation actually
begins and after the exception handler has run.
[ bp: Massage commit message. ]
BUG=b/309804303
TEST=presubmit
RELEASE_NOTE=Fixes CVE-2023-46813.
SOURCE=UPSTREAM(63e44bc52047)
Fixes: 597cfe48212a ("x86/boot/compressed/64: Setup a GHCB-based VC Exception handler")
Reported-by: Tom Dohrmann <erbse.13@gmx.de>
Change-Id: Ic0f52ed445d6410f059add5c5f0b3a061cb77d69
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Cc: <stable@kernel.org>
Reviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/61355
Reviewed-by: Oleksandr Tymoshenko <ovt@google.com>
Tested-by: Cusky Presubmit Bot <presubmit@cos-infra-prod.iam.gserviceaccount.com>
2 files changed
