Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5119ffd4 authored by Paolo Bonzini's avatar Paolo Bonzini Committed by Greg Kroah-Hartman
Browse files

KVM: x86: fix out-of-bounds write in KVM_GET_EMULATED_CPUID (CVE-2019-19332) 



commit 433f4ba1904100da65a311033f17a9bf586b287e upstream.

The bounds check was present in KVM_GET_SUPPORTED_CPUID but not
KVM_GET_EMULATED_CPUID.

Reported-by: default avatar <syzbot+e3f4897236c4eeb8af4f@syzkaller.appspotmail.com>
Fixes: 84cffe49 ("kvm: Emulate MOVBE", 2013-10-29)
Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
Cc: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 9852d0c6

arch/x86/kvm/cpuid.c

+4 −1
Original line number Original line Diff line number Diff line
@@ -420,7 +420,7 @@ static inline int __do_cpuid_ent(struct kvm_cpuid_entry2 *entry, u32 function, 




	r = -E2BIG;

	r = -E2BIG;





	if (*nent >= maxnent)

	if (WARN_ON(*nent >= maxnent))

		goto out;

		goto out;





	do_cpuid_1_ent(entry, function, index);

	do_cpuid_1_ent(entry, function, index);
@@ -729,6 +729,9 @@ static inline int __do_cpuid_ent(struct kvm_cpuid_entry2 *entry, u32 function, 
static int do_cpuid_ent(struct kvm_cpuid_entry2 *entry, u32 func,

static int do_cpuid_ent(struct kvm_cpuid_entry2 *entry, u32 func,

			u32 idx, int *nent, int maxnent, unsigned int type)

			u32 idx, int *nent, int maxnent, unsigned int type)

{

{

	if (*nent >= maxnent)

		return -E2BIG;



	if (type == KVM_GET_EMULATED_CPUID)

	if (type == KVM_GET_EMULATED_CPUID)

		return __do_cpuid_ent_emulated(entry, func, idx, nent, maxnent);

		return __do_cpuid_ent_emulated(entry, func, idx, nent, maxnent);