In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use<\/p>\n
As per the GHCB spec, when using GHCB v2+ require the software scratch area
\nto reside in the GHCB’s shared buffer. Note, things like Page State Change
\n(PSC) requests _rely_ on this behavior, as the guest can’t provide a length
\nwhen making the request, i.e. the size of the guest payload is bounded by
\nthe size of the shared buffer.<\/p>\n
Failure to force usage of the GHCB, and a slew of other flaws, lets a
\nmalicious SNP guest corrupt host kernel heap memory, and leak host heap
\nlayout information.<\/p>\n
setup_vmgexit_scratch() allocates a buffer via kvzalloc(exit_info_2),
\nwhere exit_info_2 is guest-controlled. With exit_info_2=24, this yields
\na 24-byte allocation in kmalloc-cg-32 (32-byte slab objects). The buffer
\nholds an 8-byte psc_hdr followed by 8-byte psc_entry structs, so only
\nentries[0] and entries[1] are in-bounds.<\/p>\n
snp_begin_psc() validates end_entry against VMGEXIT_PSC_MAX_COUNT (253)
\nbut NOT against the actual buffer size:<\/p>\n
idx_end = hdr->end_entry;<\/p>\n
if (idx_end >= VMGEXIT_PSC_MAX_COUNT) { \/\/ checks 253, not buffer
\n snp_complete_psc(svm, …);
\n return 1;
\n }<\/p>\n
for (idx = idx_start; idx = 2<\/p>\n
The guest sets end_entry=10+, causing the host to iterate entries[2+]
\nwhich are OOB into adjacent slab objects. For each OOB entry:<\/p>\n
– The host reads 8 bytes (OOB READ \/ info leak oracle)
\n – If the data passes PSC validation, __snp_complete_one_psc() writes
\n cur_page = 1 or 512 into the entry (OOB WRITE, sev.c:3806)
\n – If validation fails, the error response reveals whether adjacent
\n memory is zero vs non-zero (information disclosure to guest)<\/p>\n
The guest controls allocation size (exit_info_2), entry range
\n(cur_entry\/end_entry), and can fire unlimited VMGEXITs to repeatedly
\nhit different slab positions.<\/p>\n
By exploiting the variety of bugs, a malicious SEV-SNP guest can:
\n – OOB read adjacent kmalloc-cg-32 objects (heap layout disclosure)
\n – OOB write cur_page bits into adjacent objects (heap corruption)
\n – Trigger use-after-free conditions across VMGEXITs<\/p>\n
E.g. with KASAN enabled, a single insmod of the PoC guest module
\nproduces 73 KASAN reports:<\/p>\n
BUG: KASAN: slab-out-of-bounds in snp_begin_psc+0x126\/0x890
\n Read of size 8 at addr ffff888219ffb5e0 by task qemu-system-x86\/2199<\/p>\n
BUG: KASAN: slab-out-of-bounds in snp_begin_psc+0x468\/0x890
\n Write of size 8 at addr ffff888351566648 by task qemu-system-x86\/2199<\/p>\n
The buggy address belongs to the object at ffff888XXXXXXXXX
\n which belongs to the cache kmalloc-cg-32 of size 32
\n The buggy address is located N bytes to the right of
\n allocated 32-byte region [ffff888XXXXXXXXX, ffff888XXXXXXXXX)<\/p>\n
Breakdown:
\n 62 slab-out-of-bounds (reads + writes past allocation)
\n 7 slab-use-after-free
\n 4 use-after-free<\/p>\n
All credit to Stan for the wonderful description and reproducer!<\/p>\n
[sean: write changelog]<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use<\/p>\n
As per the GHCB spec, when using GHCB v2+ require the software scratc<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-12896","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/12896","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=12896"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=12896"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=12896"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}