tree 1a290e51ac7216f9b30aafe585d08e1279c5f572
parent d91a0f568458c14593dc5ba50b68618a8a06dd23
author Joerg Roedel <jroedel@suse.de> 1697460170 +0200
committer Joshua Emele <jemele@google.com> 1700266220 +0000

x86/sev: Check for user-space IOIO pointing to kernel space

[ upstream commit 63e44bc52047f182601e7817da969a105aa1f721 ]

Check the memory operand of INS/OUTS before emulating the instruction.
The #VC exception can get raised from user-space, but the memory operand
can be manipulated to access kernel memory before the emulation actually
begins and after the exception handler has run.

  [ bp: Massage commit message. ]

BUG=b/309804303
TEST=presubmit
RELEASE_NOTE=Fixes CVE-2023-46813.
SOURCE=UPSTREAM(63e44bc52047)

Fixes: 597cfe48212a ("x86/boot/compressed/64: Setup a GHCB-based VC Exception handler")
Reported-by: Tom Dohrmann <erbse.13@gmx.de>
Change-Id: Ic0f52ed445d6410f059add5c5f0b3a061cb77d69
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Cc: <stable@kernel.org>
Reviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/61355
Reviewed-by: Oleksandr Tymoshenko <ovt@google.com>
Tested-by: Cusky Presubmit Bot <presubmit@cos-infra-prod.iam.gserviceaccount.com>