[Xen-changelog] [xen stable-4.3] x86emul: fully ignore segment override for register-only operations

[patchbot@xxxxxxx]

commit 7d6effa69e62818b7d02e50eec84a6f4c76696ba
Author:     Jan Beulich <jbeulich@xxxxxxxx>
AuthorDate: Tue Mar 10 13:59:15 2015 +0100
Commit:     Jan Beulich <jbeulich@xxxxxxxx>
CommitDate: Tue Mar 10 13:59:15 2015 +0100

    x86emul: fully ignore segment override for register-only operations
    
    For ModRM encoded instructions with register operands we must not
    overwrite ea.mem.seg (if a - bogus in that case - segment override was
    present) as it aliases with ea.reg.
    
    This is CVE-2015-2151 / XSA-123.
    
    Reported-by: Felix Wilhelm <fwilhelm@xxxxxxx>
    Signed-off-by: Jan Beulich <jbeulich@xxxxxxxx>
    Reviewed-by: Tim Deegan <tim@xxxxxxx>
    Reviewed-by: Keir Fraser <keir@xxxxxxx>
    master commit: bcf92a5382b75fd964c1f8678b2d9a3abe6dec39
    master date: 2015-03-10 13:45:51 +0100
---
 xen/arch/x86/x86_emulate/x86_emulate.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/xen/arch/x86/x86_emulate/x86_emulate.c 
b/xen/arch/x86/x86_emulate/x86_emulate.c
index 2b6a509..164c2d1 100644
--- a/xen/arch/x86/x86_emulate/x86_emulate.c
+++ b/xen/arch/x86/x86_emulate/x86_emulate.c
@@ -1640,7 +1640,7 @@ x86_emulate(
         }
     }
 
-    if ( override_seg != -1 )
+    if ( override_seg != -1 && ea.type == OP_MEM )
         ea.mem.seg = override_seg;
 
     /* Decode and fetch the source operand: register, memory or immediate. */
--
generated by git-patchbot for /home/xen/git/xen.git#stable-4.3

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog