[Xen-changelog] [xen stable-4.4] x86/emul: Correct the handling of eflags with SYSCALL

[patchbot@xxxxxxx]

commit 5a343e41f55d23c74fa3bdf430dacfa47a1a74d7
Author:     Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
AuthorDate: Sun Dec 18 15:42:59 2016 +0000
Commit:     Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
CommitDate: Mon Dec 19 15:46:47 2016 +0000

    x86/emul: Correct the handling of eflags with SYSCALL
    
    A singlestep #DB is determined by the resulting eflags value from the
    execution of SYSCALL, not the original eflags value.
    
    By using the original eflags value, we negate the guest kernels attempt to
    protect itself from a privilege escalation by masking TF.
    
    Introduce a tf boolean and have the SYSCALL emulation recalculate it
    after the instruction is complete.
    
    This is XSA-204
    
    Signed-off-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
    Reviewed-by: Jan Beulich <jbeulich@xxxxxxxx>
---
 xen/arch/x86/x86_emulate/x86_emulate.c | 23 ++++++++++++++++++++---
 1 file changed, 20 insertions(+), 3 deletions(-)

diff --git a/xen/arch/x86/x86_emulate/x86_emulate.c 
b/xen/arch/x86/x86_emulate/x86_emulate.c
index 1f7c2cf..353b1cb 100644
--- a/xen/arch/x86/x86_emulate/x86_emulate.c
+++ b/xen/arch/x86/x86_emulate/x86_emulate.c
@@ -1392,6 +1392,7 @@ x86_emulate(
     union vex vex = {};
     unsigned int op_bytes, def_op_bytes, ad_bytes, def_ad_bytes;
     bool_t lock_prefix = 0;
+    bool_t tf = !!(ctxt->regs->eflags & EFLG_TF);
     int override_seg = -1, rc = X86EMUL_OKAY;
     struct operand src = { .reg = REG_POISON };
     struct operand dst = { .reg = REG_POISON };
@@ -3718,9 +3719,8 @@ x86_emulate(
         break;
     }
 
-    /* Inject #DB if single-step tracing was enabled at instruction start. */
-    if ( (ctxt->regs->eflags & EFLG_TF) && (rc == X86EMUL_OKAY) &&
-         (ops->inject_hw_exception != NULL) )
+    /* Should a singlestep #DB be raised? */
+    if ( tf && (rc == X86EMUL_OKAY) && (ops->inject_hw_exception != NULL) )
         rc = ops->inject_hw_exception(EXC_DB, -1, ctxt) ? : X86EMUL_EXCEPTION;
 
     /* Commit shadow register state. */
@@ -3905,6 +3905,23 @@ x86_emulate(
              (rc = ops->write_segment(x86_seg_ss, &ss, ctxt)) )
             goto done;
 
+        /*
+         * SYSCALL (unlike most instructions) evaluates its singlestep action
+         * based on the resulting EFLG_TF, not the starting EFLG_TF.
+         *
+         * As the #DB is raised after the CPL change and before the OS can
+         * switch stack, it is a large risk for privilege escalation.
+         *
+         * 64bit kernels should mask EFLG_TF in MSR_FMASK to avoid any
+         * vulnerability.  Running the #DB handler on an IST stack is also a
+         * mitigation.
+         *
+         * 32bit kernels have no ability to mask EFLG_TF at all.  Their only
+         * mitigation is to use a task gate for handling #DB (or to not use
+         * enable EFER.SCE to start with).
+         */
+        tf = !!(_regs.eflags & EFLG_TF);
+
         break;
     }
 
--
generated by git-patchbot for /home/xen/git/xen.git#stable-4.4

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxx
https://lists.xenproject.org/xen-changelog