Re: [Xen-devel] [PATCH v2 2/3] x86/emulate: add support of emulating SSE2 instruction {, v}movd mm, m32

[Andrew Cooper <andrew.cooper3@xxxxxxxxxx>]

On 18/07/16 15:30, Mihai Donțu wrote:
> @@ -4409,6 +4409,10 @@ x86_emulate(
>      case 0x6f: /* movq mm/m64,mm */
>                 /* {,v}movdq{a,u} xmm/m128,xmm */
>                 /* vmovdq{a,u} ymm/m256,ymm */
> +    case 0x7e: /* movd mm,r/m32 */
> +               /* movq mm,r/m64 */
> +               /* {,v}movd xmm,r/m32 */
> +               /* {,v}movq xmm,r/m64 */

This exposes a vulnerability where a guest can clobber local state in
x86_emulate, by specifying registers such as %ebx as the destination.

You must either
1) Move this case up above the fail_if(ea.type != OP_MEM); check, or
2) modify the stub logic to convert a GPR destination to a memory
address pointing into _regs.

~Andrew

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
https://lists.xen.org/xen-devel