[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] [Xen-changelog] [xen master] x86emul: fully ignore segment override for register-only operations
commit bcf92a5382b75fd964c1f8678b2d9a3abe6dec39 Author: Jan Beulich <jbeulich@xxxxxxxx> AuthorDate: Tue Mar 10 13:45:51 2015 +0100 Commit: Jan Beulich <jbeulich@xxxxxxxx> CommitDate: Tue Mar 10 13:45:51 2015 +0100 x86emul: fully ignore segment override for register-only operations For ModRM encoded instructions with register operands we must not overwrite ea.mem.seg (if a - bogus in that case - segment override was present) as it aliases with ea.reg. This is CVE-2015-2151 / XSA-123. Reported-by: Felix Wilhelm <fwilhelm@xxxxxxx> Signed-off-by: Jan Beulich <jbeulich@xxxxxxxx> Reviewed-by: Tim Deegan <tim@xxxxxxx> Reviewed-by: Keir Fraser <keir@xxxxxxx> --- xen/arch/x86/x86_emulate/x86_emulate.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/xen/arch/x86/x86_emulate/x86_emulate.c b/xen/arch/x86/x86_emulate/x86_emulate.c index 5e9e040..0c73695 100644 --- a/xen/arch/x86/x86_emulate/x86_emulate.c +++ b/xen/arch/x86/x86_emulate/x86_emulate.c @@ -1757,7 +1757,7 @@ x86_emulate( } } - if ( override_seg != -1 ) + if ( override_seg != -1 && ea.type == OP_MEM ) ea.mem.seg = override_seg; /* Early operand adjustments. */ -- generated by git-patchbot for /home/xen/git/xen.git#master _______________________________________________ Xen-changelog mailing list Xen-changelog@xxxxxxxxxxxxx http://lists.xensource.com/xen-changelog
|
![]() |
Lists.xenproject.org is hosted with RackSpace, monitoring our |